Skip to content

Commit 8fae76f

Browse files
nileshgadgiclouddrove-ci
nileshgadgi
and
clouddrove-ci
authored
Feat: Introduce Powerpipe shared workflow (#156)
Co-authored-by: CloudDrove CI <[email protected]>
1 parent 26e6886 commit 8fae76f

File tree

5 files changed

+320
-0
lines changed

5 files changed

+320
-0
lines changed

‎.github/workflows/powerpipe.yml‎

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
---
2+
name: 'Powerpipe Workflow'
3+
4+
on:
5+
workflow_call:
6+
inputs:
7+
cloud_provider:
8+
description: 'Cloud Provider Name. i.g. AWS, Azure, GCP, OCI'
9+
required: true
10+
type: string
11+
default: 'AWS'
12+
mod_url:
13+
description: 'Powerpipe Mod URL. Get URL from here: https://hub.powerpipe.io/'
14+
required: false
15+
type: string
16+
default: 'https://github.com/turbot/steampipe-mod-aws-thrifty'
17+
plugin_connection:
18+
description: 'Powerpipe plugin-connection to establish the connection between powerpipe and plugin.'
19+
required: false
20+
type: string
21+
default: |
22+
connection "aws" {
23+
plugin = "aws"
24+
}
25+
controls:
26+
description: 'Controlers to run in powerpipe'
27+
required: false
28+
type: string
29+
benchmarks:
30+
description: 'Powerpipe step benchmarks to scan in specific mod.'
31+
required: false
32+
type: string
33+
default: |
34+
all
35+
36+
# GCP Authentication
37+
create_credentials_file:
38+
required: false
39+
type: string
40+
default: true
41+
description: 'If true, the action will securely generate a credentials file which can be used for authentication via gcloud and Google Cloud SDKs.'
42+
token_format:
43+
required: false
44+
type: string
45+
default: access_token
46+
description: 'Output format for the generated authentication token. For OAuth 2.0 access tokens, specify "access_token". For OIDC tokens, specify "id_token". To skip token generation, leave this value empty'
47+
access_token_lifetime:
48+
required: false
49+
type: string
50+
default: 300s
51+
description: 'Desired lifetime duration of the access token, in seconds'
52+
project_id:
53+
required: false
54+
type: string
55+
description: 'ID of the default project to use for future API calls and invocations.'
56+
57+
secrets:
58+
TOKEN:
59+
description: 'GitHub Token'
60+
required: false
61+
62+
# AWS Authentication
63+
aws_assume_role:
64+
description: 'AWS IAM role to assume. Necessary if cloud_provider is AWS.'
65+
required: false
66+
67+
# Azure Authentication
68+
AZURE_CLIENT_ID:
69+
description: 'Client ID of Azure cloud OIDC.'
70+
required: false
71+
AZURE_TENANT_ID:
72+
description: 'Tenant ID of aure cloud OIDC.'
73+
required: false
74+
SUBSCRIPTION_ID:
75+
description: 'Subscript ID of Azure Cloud OIDC.'
76+
required: false
77+
78+
# GCP Authentication
79+
GCP_CREDENTIALS:
80+
description: 'The Google Cloud JSON service account key to use for authentication'
81+
required: false
82+
WORKLOAD_IDENTITY_PROVIDER:
83+
required: false
84+
description: 'The full identifier of the Workload Identity Provider'
85+
SERVICE_ACCOUNT:
86+
required: false
87+
description: 'The service account to be used'
88+
89+
jobs:
90+
powerpipe:
91+
name: 'Powerpipe Shared Workflow'
92+
runs-on: ubuntu-latest
93+
steps:
94+
- name: Checkout repo
95+
uses: actions/checkout@v4
96+
97+
- name: Setup AWS Credentials
98+
uses: aws-actions/configure-aws-credentials@v4
99+
with:
100+
role-to-assume: ${{ secrets.aws_assume_role }}
101+
role-session-name: powerpipe
102+
aws-region: us-east-1
103+
if: ${{ inputs.cloud_provider == 'AWS' }}
104+
105+
- name: 'Authenticate to Google Cloud'
106+
uses: 'google-github-actions/auth@v2'
107+
with:
108+
credentials_json: '${{ secrets.GCP_CREDENTIALS }}'
109+
create_credentials_file: ${{ inputs.create_credentials_file }}
110+
token_format: ${{ inputs.token_format }}
111+
workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
112+
service_account: ${{ secrets.SERVICE_ACCOUNT }}
113+
access_token_lifetime: ${{ inputs.access_token_lifetime }}
114+
project_id: ${{ inputs.project_id }}
115+
if: ${{ inputs.cloud_provider == 'GCP' }}
116+
117+
- name: Authenticate to Azure Cloud
118+
uses: azure/login@v1
119+
with:
120+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
121+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
122+
subscription-id: ${{ secrets.SUBSCRIPTION_ID }}
123+
if: ${{ inputs.cloud_provider == 'AZURE' }}
124+
125+
- name: Setup Steampipe
126+
uses: turbot/steampipe-action-setup@v1
127+
with:
128+
plugin-connections: ${{ inputs.plugin_connection }}
129+
130+
- name: Install Powerpipe
131+
uses: turbot/powerpipe-action-setup@v1
132+
133+
- name: Start steampipe service
134+
run: |
135+
steampipe service start
136+
137+
- name: Run Terraform AWS Compliance control
138+
uses: turbot/powerpipe-action-check@v1
139+
with:
140+
mod-url: ${{ inputs.mod_url }}
141+
controls: ${{ inputs.controls }}
142+
benchmarks: ${{ inputs.benchmarks }}
143+
github-token: ${{ secrets.TOKEN }}
144+
145+
- name: Read generated markdown file
146+
id: read_md_file
147+
run: |
148+
# Read the content of the generated .md file into an environment variable
149+
FILE_PATH="${{ github.workspace }}/*.md"
150+
MD_CONTENT=$(cat $FILE_PATH)
151+
echo "md_content<<EOF" >> $GITHUB_ENV
152+
echo "$MD_CONTENT" >> $GITHUB_ENV
153+
echo "EOF" >> $GITHUB_ENV
154+
155+
- name: Comment on the PR with the markdown report
156+
uses: peter-evans/create-or-update-comment@v3
157+
with:
158+
token: ${{ secrets.TOKEN }}
159+
issue-number: ${{ github.event.pull_request.number }}
160+
body: |
161+
## Terraform Compliance Report
162+
${{ env.md_content }}
163+
continue-on-error: true
164+
...

‎docs/powerpipe.md‎

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
## [Powerpipe Workflow](https://github.com/clouddrove/github-shared-workflows/blob/master/.github/workflows/powerpipe.yml)
2+
Powerpipe is useful to scan cloud infrastructuer and plan cost optimization or find cloud infrastructure vulnerabilities using high level benchmarks as per industry trends.
3+
It utilizes the workflows defined in `.github/workflows/powerpipe.yml`
4+
5+
#### Usage
6+
- It will put the comment in Github Pull request if it's the pull request for terraform vulnerabilities, cost optimisation report, cloud benchmark testing report or any other. You just have to pass the workflow inputs accordingly.
7+
- Visualize cloud configurations. Assess security posture against a massive library of benchmarks. Build custom dashboards with code.
8+
- The only dashboarding tool designed from the ground up to visualize DevOps data. Explore your cloud, understand relationships and drill down to the details.
9+
10+
#### Get started
11+
- First you need pass that which cloud provider you want to use. Use `cloud_provider` argument in the workflow.
12+
- Choose which mod you want to use. There are multiple mods according to the requirement choose wisely. Here is the list of mod you can use: https://hub.powerpipe.io/
13+
- Use mentioned plugins according to the examples shown below.
14+
- For custom benchmarks and controls, use the `benchmarks` and `controls` argument.
15+
- To authenticate with the AWS account or GCP, pass the shown keys and their values like below:
16+
- AWS:
17+
- `ASSUME_ROLE`
18+
- GCP:
19+
-
20+
21+
22+
**Powerpipe Reference Link:** https://powerpipe.io/
23+
24+
### Examples
25+
26+
#### PowerPipe with Terraform
27+
```yaml
28+
name: "PowerPipe for Terraform"
29+
permissions:
30+
id-token: write
31+
issues: write
32+
pull-requests: write
33+
34+
on:
35+
pull_request:
36+
37+
jobs:
38+
powerpipe:
39+
uses: clouddrove/github-shared-workflows/.github/workflows/powerpipe.yml@master
40+
with:
41+
cloud_provider: 'AWS'
42+
mod_url: "https://github.com/turbot/steampipe-mod-terraform-aws-compliance"
43+
plugin_connection: |
44+
connection "aws_tf" {
45+
plugin = "terraform"
46+
configuration_file_paths = [
47+
"terraform/aws/**/*.tf"
48+
]
49+
}
50+
connection "aws" {
51+
plugin = "aws"
52+
}
53+
benchmarks: |
54+
ec2
55+
secrets:
56+
TOKEN: ${{ secrets.GITHUB_TOKEN }} ## Change the workflow permissions to change this Token's permissions
57+
aws_assume_role: ${{ secrets.assume_role }} ## Assume IAM Role to assume AWS account
58+
```
59+
60+
#### PowerPipe for Cost Optimization Report - AWS
61+
```yaml
62+
name: "PowerPipe for Cost Optimization Report"
63+
permissions:
64+
id-token: write
65+
issues: write
66+
pull-requests: write
67+
on:
68+
pull_request:
69+
push:
70+
branches:
71+
- 'master'
72+
- 'main'
73+
74+
jobs:
75+
powerpipe:
76+
uses: clouddrove/github-shared-workflows/.github/workflows/powerpipe.yml@master
77+
with:
78+
cloud_provider: 'AWS'
79+
mod_url: "https://github.com/turbot/steampipe-mod-aws-thrifty"
80+
plugin_connection: |
81+
connection "aws" {
82+
plugin = "aws"
83+
}
84+
benchmarks: |
85+
ec2
86+
secrets:
87+
TOKEN: ${{ secrets.GITHUB_TOKEN }} ## Change the workflow permissions to change this Token's permissions
88+
aws_assume_role: ${{ secrets.assume_role }} ## Assume IAM Role to assume AWS account
89+
```
90+
91+
#### PowerPipe for Cost Optimization Report - Azure
92+
```yaml
93+
name: "PowerPipe for Cost Optimization Report"
94+
permissions:
95+
id-token: write
96+
issues: write
97+
pull-requests: write
98+
on:
99+
pull_request:
100+
push:
101+
branches:
102+
- 'master'
103+
- 'main'
104+
105+
jobs:
106+
powerpipe:
107+
uses: clouddrove/github-shared-workflows/.github/workflows/powerpipe.yml@master
108+
with:
109+
cloud_provider: 'AZURE'
110+
mod_url: "https://github.com/turbot/steampipe-mod-azure-thrifty"
111+
plugin_connection: |
112+
connection "azure" {
113+
plugin = "azure"
114+
}
115+
benchmarks: |
116+
compute # Check benchmark lists here: https://hub.powerpipe.io/mods/turbot/azure_thrifty/controls#benchmarks
117+
secrets:
118+
TOKEN: ${{ secrets.GITHUB_TOKEN }} ## Change the workflow permissions to change this Token's permissions
119+
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
120+
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
121+
SUBSCRIPTION_ID: ${{ secrets.SUBSCRIPTION_ID }}
122+
```
123+
124+
125+
#### PowerPipe for Cloud compliances
126+
```yaml
127+
name: "PowerPipe on Compliances"
128+
permissions:
129+
id-token: write
130+
issues: write
131+
pull-requests: write
132+
on:
133+
pull_request:
134+
push:
135+
branches:
136+
- 'master'
137+
- 'main'
138+
139+
jobs:
140+
powerpipe:
141+
uses: clouddrove/github-shared-workflows/.github/workflows/powerpipe.yml@master
142+
with:
143+
cloud_provider: 'AWS'
144+
secrets:
145+
TOKEN: ${{ secrets.GITHUB_TOKEN }} ## Change the workflow permissions to change this Token's permissions
146+
aws_assume_role: ${{ secrets.assume_role }} ## Assume IAM Role to assume AWS account
147+
```
148+
149+
<br><br><br>
150+
Show below picture for more understanding
151+
152+
![image1](https://github.com/clouddrove/github-shared-workflows/blob/master/images/powerpipe-readme-1.png)
153+
154+
![image2](https://github.com/clouddrove/github-shared-workflows/blob/master/images/powerpipe-readme-2.png)
155+
156+
![image3](https://github.com/clouddrove/github-shared-workflows/blob/master/images/powerpipe-readme-3.png)

‎images/powerpipe-readme-1.png‎

79.4 KB
Loading

‎images/powerpipe-readme-2.png‎

131 KB
Loading

‎images/powerpipe-readme-3.png‎

114 KB
Loading

0 commit comments

Comments
 (0)