Skip to content

Commit c1c7639

Browse files
gautambaghelgautambaghel
authored
Initial setup for anthropic analyzer (#1)
* initial setup for anthropic analyzer * fix checkov * update gitignore * skip e2e test --------- Co-authored-by: wellsiau-aws <[email protected]> and Gautam Baghel
1 parent 13c1b69 commit c1c7639

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+3358
-72
lines changed

‎.gitignore‎

Lines changed: 12 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,3 @@
1-
build/
2-
plan.out
3-
plan.out.json
4-
51
# Local .terraform directories
62
**/.terraform/*
73

@@ -11,13 +7,18 @@ plan.out.json
117

128
# Crash log files
139
crash.log
10+
crash.*.log
1411

15-
# Exclude all .tfvars files, which are likely to contain sentitive data, such as
16-
# password, private keys, and other secrets. These should not be part of version
17-
# control as they are data points which are potentially sensitive and subject
12+
# Exclude all .tfvars files, which are likely to contain sensitive data, such as
13+
# password, private keys, and other secrets. These should not be part of version
14+
# control as they are data points which are potentially sensitive and subject
1815
# to change depending on the environment.
19-
#
2016
*.tfvars
17+
*.tfvars.json
18+
19+
# Generated files
20+
src/post_plan
21+
src/pre_plan
2122

2223
# Ignore override files as they are usually used to override resources locally and so
2324
# are not checked in
@@ -27,7 +28,6 @@ override.tf.json
2728
*_override.tf.json
2829

2930
# Include override files you do wish to add to version control using negated pattern
30-
#
3131
# !example_override.tf
3232

3333
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
@@ -38,9 +38,6 @@ override.tf.json
3838
terraform.rc
3939
.terraform.lock.hcl
4040

41-
# Terratest / GoLang
42-
go.mod
43-
go.sum
44-
45-
# Terraform tests
46-
tests/*.auto.tfvars
41+
**/site-packages
42+
*.zip
43+
settings.json

‎.header.md‎

Lines changed: 30 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,33 @@
1-
# Terraform Module Project
1+
# terraform-aws-plan-analyzer-runtask
22

3-
:no_entry_sign: Do not edit this readme.md file. To learn how to change this content and work with this repository, refer to CONTRIBUTING.md
3+
Use this module to develop HCP Terraform run task and deploy it in AWS.
44

5-
## Readme Content
5+
![Diagram](./images/arch.png)
66

7-
This file will contain any instructional information about this module.
7+
## Prerequisites
8+
9+
To use this module you need have the following:
10+
11+
1. AWS account and credentials
12+
1. HCP Terraform account
13+
14+
## Usage
15+
16+
1. Reference the `examples/basic` folder on how to use this module
17+
18+
```sh
19+
cd examples/basic
20+
terraform init
21+
terraform plan
22+
terraform apply
23+
```
24+
25+
## Best practice
26+
27+
* **Do not** re-use the Run Tasks URL across different trust-boundary (organizations, accounts, team). We recommend you to deploy separate Run Task deployment per trust-boundary.
28+
29+
* **Do not** use Run Tasks URL from untrusted party, remember that Run Tasks execution sent Terraform plan output to the Run Task endpoint. Only use trusted Run Tasks URL.
30+
31+
* Enable the AWS WAF setup by setting variable `deploy_waf` to `true` (additional cost will apply). This will add WAF protection to the Run Tasks URL endpoint.
32+
33+
* We recommend you to setup additional CloudWatch alarm to monitor Lambda concurrency and WAF rules.

‎.pre-commit-config.yaml‎

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,16 +2,28 @@
22
fail_fast: false
33
minimum_pre_commit_version: "2.6.0"
44
repos:
5-
-
6-
repo: https://github.com/terraform-docs/terraform-docs
7-
# To update run:
8-
# pre-commit autoupdate --freeze
9-
rev: 212db41760d7fc45d736d5eb94a483d0d2a12049 # frozen: v0.16.0
5+
- repo: https://github.com/terraform-docs/terraform-docs
6+
rev: 212db41760d7fc45d736d5eb94a483d0d2a12049 # frozen: v0.16.0 To update run: `pre-commit autoupdate --freeze`
107
hooks:
118
- id: terraform-docs-go
12-
args:
9+
args:
1310
- "--config=.config/.terraform-docs.yaml"
1411
- "--lockfile=false"
1512
- "--recursive"
1613
- "--recursive-path=examples/"
17-
- "./"
14+
- "./"
15+
- repo: https://github.com/antonbabenko/pre-commit-terraform
16+
rev: v1.81.0
17+
hooks:
18+
- id: terraform_fmt
19+
- repo: meta
20+
hooks:
21+
- id: check-useless-excludes
22+
- repo: https://github.com/pre-commit/pre-commit-hooks
23+
rev: v4.4.0
24+
hooks:
25+
- id: trailing-whitespace
26+
- id: check-added-large-files
27+
- id: check-json
28+
- id: check-yaml
29+
- id: detect-private-key

‎Makefile‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
TOPTARGETS := all clean build
2+
3+
SUBDIRS := $(wildcard lambda/*/.)
4+
BASE = $(shell /bin/pwd)
5+
6+
$(TOPTARGETS): $(SUBDIRS)
7+
8+
$(SUBDIRS):
9+
$(MAKE) -C $@ $(MAKECMDGOALS) $(ARGS) BASE="${BASE}"
10+
11+
.PHONY: $(TOPTARGETS) $(SUBDIRS)
12+
13+
clean:
14+
rm -f .terraform.lock.hcl
15+
rm -rf .terraform
16+
rm -rf ./lambda/*.zip
17+
rm -f ./test/go.mod
18+
rm -f ./test/go.sum
19+
rm -f tf.json
20+
rm -f tf.plan
21+
rm -f *.tfvars

‎README.md‎

Lines changed: 126 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,147 @@
11
<!-- BEGIN_TF_DOCS -->
2-
# Terraform Module Project
2+
# terraform-aws-plan-analyzer-runtask
33

4-
:no_entry_sign: Do not edit this readme.md file. To learn how to change this content and work with this repository, refer to CONTRIBUTING.md
4+
Use this module to develop HCP Terraform run task and deploy it in AWS.
55

6-
## Readme Content
6+
![Diagram](./images/arch.png)
77

8-
This file will contain any instructional information about this module.
8+
## Prerequisites
9+
10+
To use this module you need have the following:
11+
12+
1. AWS account and credentials
13+
1. HCP Terraform account
14+
15+
## Usage
16+
17+
1. Reference the `examples/basic` folder on how to use this module
18+
19+
```sh
20+
cd examples/basic
21+
terraform init
22+
terraform plan
23+
terraform apply
24+
```
25+
26+
## Best practice
27+
28+
* **Do not** re-use the Run Tasks URL across different trust-boundary (organizations, accounts, team). We recommend you to deploy separate Run Task deployment per trust-boundary.
29+
30+
* **Do not** use Run Tasks URL from untrusted party, remember that Run Tasks execution sent Terraform plan output to the Run Task endpoint. Only use trusted Run Tasks URL.
31+
32+
* Enable the AWS WAF setup by setting variable `deploy_waf` to `true` (additional cost will apply). This will add WAF protection to the Run Tasks URL endpoint.
33+
34+
* We recommend you to setup additional CloudWatch alarm to monitor Lambda concurrency and WAF rules.
935

1036
## Requirements
1137

38+
| Name | Version |
39+
|------|---------|
40+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.0 |
41+
| <a name="requirement_archive"></a> [archive](#requirement\_archive) | ~>2.2.0 |
42+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.47.0 |
43+
| <a name="requirement_random"></a> [random](#requirement\_random) | >=3.4.0 |
44+
1245
## Providers
1346

14-
No providers.
47+
| Name | Version |
48+
|------|---------|
49+
| <a name="provider_archive"></a> [archive](#provider\_archive) | ~>2.2.0 |
50+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.47.0 |
51+
| <a name="provider_aws.cloudfront_waf"></a> [aws.cloudfront\_waf](#provider\_aws.cloudfront\_waf) | >= 5.47.0 |
52+
| <a name="provider_random"></a> [random](#provider\_random) | >=3.4.0 |
53+
| <a name="provider_terraform"></a> [terraform](#provider\_terraform) | n/a |
1554

1655
## Modules
1756

18-
No modules.
57+
| Name | Source | Version |
58+
|------|--------|---------|
59+
| <a name="module_runtask_cloudfront"></a> [runtask\_cloudfront](#module\_runtask\_cloudfront) | terraform-aws-modules/cloudfront/aws | 3.2.1 |
1960

2061
## Resources
2162

22-
No resources.
63+
| Name | Type |
64+
|------|------|
65+
| [aws_cloudfront_origin_request_policy.runtask_cloudfront](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_origin_request_policy) | resource |
66+
| [aws_cloudwatch_event_rule.runtask_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource |
67+
| [aws_cloudwatch_event_target.runtask_target](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource |
68+
| [aws_cloudwatch_log_group.runtask_callback](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
69+
| [aws_cloudwatch_log_group.runtask_eventbridge](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
70+
| [aws_cloudwatch_log_group.runtask_fulfillment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
71+
| [aws_cloudwatch_log_group.runtask_fulfillment_output](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
72+
| [aws_cloudwatch_log_group.runtask_request](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
73+
| [aws_cloudwatch_log_group.runtask_states](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
74+
| [aws_cloudwatch_log_group.runtask_waf](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
75+
| [aws_iam_role.runtask_callback](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
76+
| [aws_iam_role.runtask_eventbridge](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
77+
| [aws_iam_role.runtask_fulfillment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
78+
| [aws_iam_role.runtask_request](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
79+
| [aws_iam_role.runtask_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
80+
| [aws_iam_role.runtask_states](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
81+
| [aws_iam_role_policy.runtask_eventbridge](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
82+
| [aws_iam_role_policy.runtask_fulfillment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
83+
| [aws_iam_role_policy.runtask_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
84+
| [aws_iam_role_policy.runtask_states](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
85+
| [aws_iam_role_policy_attachment.runtask_callback](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
86+
| [aws_iam_role_policy_attachment.runtask_eventbridge](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
87+
| [aws_iam_role_policy_attachment.runtask_fulfillment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
88+
| [aws_iam_role_policy_attachment.runtask_request](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
89+
| [aws_kms_alias.runtask_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | resource |
90+
| [aws_kms_alias.runtask_waf](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | resource |
91+
| [aws_kms_key.runtask_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
92+
| [aws_kms_key.runtask_waf](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
93+
| [aws_lambda_function.runtask_callback](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function) | resource |
94+
| [aws_lambda_function.runtask_eventbridge](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function) | resource |
95+
| [aws_lambda_function.runtask_fulfillment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function) | resource |
96+
| [aws_lambda_function.runtask_request](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function) | resource |
97+
| [aws_lambda_function_url.runtask_eventbridge](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function_url) | resource |
98+
| [aws_secretsmanager_secret.runtask_cloudfront](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) | resource |
99+
| [aws_secretsmanager_secret.runtask_hmac](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) | resource |
100+
| [aws_secretsmanager_secret_version.runtask_cloudfront](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_version) | resource |
101+
| [aws_secretsmanager_secret_version.runtask_hmac](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_version) | resource |
102+
| [aws_sfn_state_machine.runtask_states](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sfn_state_machine) | resource |
103+
| [aws_wafv2_web_acl.runtask_waf](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl) | resource |
104+
| [aws_wafv2_web_acl_logging_configuration.runtask_waf](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl_logging_configuration) | resource |
105+
| [random_uuid.runtask_cloudfront](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/uuid) | resource |
106+
| [random_uuid.runtask_hmac](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/uuid) | resource |
107+
| [terraform_data.bootstrap](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
108+
| [archive_file.runtask_callback](https://registry.terraform.io/providers/hashicorp/archive/latest/docs/data-sources/file) | data source |
109+
| [archive_file.runtask_eventbridge](https://registry.terraform.io/providers/hashicorp/archive/latest/docs/data-sources/file) | data source |
110+
| [archive_file.runtask_request](https://registry.terraform.io/providers/hashicorp/archive/latest/docs/data-sources/file) | data source |
111+
| [aws_caller_identity.current_account](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
112+
| [aws_iam_policy.aws_lambda_basic_execution_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source |
113+
| [aws_iam_policy_document.runtask_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
114+
| [aws_iam_policy_document.runtask_waf](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
115+
| [aws_partition.current_partition](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
116+
| [aws_region.cloudfront_region](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
117+
| [aws_region.current_region](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
23118

24119
## Inputs
25120

26-
No inputs.
121+
| Name | Description | Type | Default | Required |
122+
|------|-------------|------|---------|:--------:|
123+
| <a name="input_aws_region"></a> [aws\_region](#input\_aws\_region) | The region from which this module will be executed. | `string` | n/a | yes |
124+
| <a name="input_hcp_tf_org"></a> [hcp\_tf\_org](#input\_hcp\_tf\_org) | HCP Terraform Organization name | `string` | n/a | yes |
125+
| <a name="input_run_task_fulfillment_image"></a> [run\_task\_fulfillment\_image](#input\_run\_task\_fulfillment\_image) | The image with the Lambda fulfillment code, please see the src/ folder for more details | `string` | n/a | yes |
126+
| <a name="input_cloudwatch_log_group_name"></a> [cloudwatch\_log\_group\_name](#input\_cloudwatch\_log\_group\_name) | RunTask CloudWatch log group name | `string` | `"/hashicorp/terraform/runtask/"` | no |
127+
| <a name="input_cloudwatch_log_group_retention"></a> [cloudwatch\_log\_group\_retention](#input\_cloudwatch\_log\_group\_retention) | Lambda CloudWatch log group retention period | `string` | `"365"` | no |
128+
| <a name="input_deploy_waf"></a> [deploy\_waf](#input\_deploy\_waf) | Set to true to deploy CloudFront and WAF in front of the Lambda function URL | `string` | `false` | no |
129+
| <a name="input_event_bus_name"></a> [event\_bus\_name](#input\_event\_bus\_name) | EventBridge event bus name | `string` | `"default"` | no |
130+
| <a name="input_event_source"></a> [event\_source](#input\_event\_source) | EventBridge source name | `string` | `"app.terraform.io"` | no |
131+
| <a name="input_lambda_default_timeout"></a> [lambda\_default\_timeout](#input\_lambda\_default\_timeout) | Lambda default timeout in seconds | `number` | `30` | no |
132+
| <a name="input_lambda_reserved_concurrency"></a> [lambda\_reserved\_concurrency](#input\_lambda\_reserved\_concurrency) | Maximum Lambda reserved concurrency, make sure your AWS quota is sufficient | `number` | `100` | no |
133+
| <a name="input_name_prefix"></a> [name\_prefix](#input\_name\_prefix) | Name to be used on all the resources as identifier. | `string` | `"hcp-tf"` | no |
134+
| <a name="input_recovery_window"></a> [recovery\_window](#input\_recovery\_window) | Numbers of day Number of days that AWS Secrets Manager waits before it can delete the secret | `number` | `0` | no |
135+
| <a name="input_run_task_iam_roles"></a> [run\_task\_iam\_roles](#input\_run\_task\_iam\_roles) | List of IAM roles to be attached to the Lambda function | `list(string)` | `null` | no |
136+
| <a name="input_runtask_stages"></a> [runtask\_stages](#input\_runtask\_stages) | List of all supported run task stages | `list(string)` | <pre>[<br> "pre_plan",<br> "post_plan",<br> "pre_apply"<br>]</pre> | no |
137+
| <a name="input_waf_managed_rule_set"></a> [waf\_managed\_rule\_set](#input\_waf\_managed\_rule\_set) | List of AWS Managed rules to use inside the WAF ACL | `list(map(string))` | <pre>[<br> {<br> "metric_suffix": "common",<br> "name": "AWSManagedRulesCommonRuleSet",<br> "priority": 10,<br> "vendor_name": "AWS"<br> },<br> {<br> "metric_suffix": "bad_input",<br> "name": "AWSManagedRulesKnownBadInputsRuleSet",<br> "priority": 20,<br> "vendor_name": "AWS"<br> }<br>]</pre> | no |
138+
| <a name="input_waf_rate_limit"></a> [waf\_rate\_limit](#input\_waf\_rate\_limit) | Rate limit for request coming to WAF | `number` | `100` | no |
139+
| <a name="input_workspace_prefix"></a> [workspace\_prefix](#input\_workspace\_prefix) | HCP Terraform workspace name prefix that allowed to run this run task | `string` | `""` | no |
27140

28141
## Outputs
29142

30-
No outputs.
31-
<!-- END_TF_DOCS -->
143+
| Name | Description |
144+
|------|-------------|
145+
| <a name="output_runtask_hmac"></a> [runtask\_hmac](#output\_runtask\_hmac) | HMAC key value, keep this sensitive data safe |
146+
| <a name="output_runtask_url"></a> [runtask\_url](#output\_runtask\_url) | The Run Tasks URL endpoint, you can use this to configure the run task setup in HCP Terraform |
147+
<!-- END_TF_DOCS -->

‎examples/basic/.header.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Usage Example
2+
3+
This is a basic example setup on using the module.
4+
5+
* Make sure the Docker image has been built and pushed from the `src` folder, [follow this Readme](../../src/README.md)
6+
7+
* Create infrastrucutre
8+
9+
```bash
10+
terraform init
11+
terraform plan
12+
terraform apply
13+
```
14+
15+
* (Optional, if using HCP Terraform) Add the cloud block in `providers.tf`
16+
17+
```hcl
18+
terraform {
19+
20+
cloud {
21+
# TODO: Change this to your HCP Terraform org name.
22+
organization = "<enter your org name here>"
23+
workspaces {
24+
...
25+
}
26+
}
27+
...
28+
}
29+
```

‎examples/basic/.terraform-docs.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
formatter: markdown
2+
header-from: .header.md
3+
settings:
4+
anchor: true
5+
color: true
6+
default: true
7+
escape: true
8+
html: true
9+
indent: 2
10+
required: true
11+
sensitive: true
12+
type: true
13+
lockfile: false
14+
15+
sort:
16+
enabled: true
17+
by: required
18+
19+
output:
20+
file: README.md
21+
mode: replace

0 commit comments

Comments
 (0)