Skip to content

Commit c130bfd

Browse files
PatMyronPatMyron
authored
mapping aws_secretsmanager (#279)
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_policy https://github.com/aws/aws-sdk-go/blob/main/models/apis/secretsmanager/2017-10-17/api-2.json
1 parent f510cdc commit c130bfd

7 files changed

+314
-0
lines changed

‎docs/rules/README.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1112,6 +1112,10 @@ These rules enforce best practices and naming conventions:
11121112
|aws_secretsmanager_secret_invalid_name|✔|
11131113
|aws_secretsmanager_secret_invalid_policy|✔|
11141114
|aws_secretsmanager_secret_invalid_rotation_lambda_arn|✔|
1115+
|aws_secretsmanager_secret_policy_invalid_policy|✔|
1116+
|aws_secretsmanager_secret_policy_invalid_secret_arn|✔|
1117+
|aws_secretsmanager_secret_rotation_invalid_rotation_lambda_arn|✔|
1118+
|aws_secretsmanager_secret_rotation_invalid_secret_id|✔|
11151119
|aws_secretsmanager_secret_version_invalid_secret_id|✔|
11161120
|aws_secretsmanager_secret_version_invalid_secret_string|✔|
11171121
|aws_securityhub_action_target_invalid_description|✔|

‎rules/models/aws_secretsmanager_secret_policy_invalid_policy.go

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
// This file generated by `generator/`. DO NOT EDIT
2+
3+
package models
4+
5+
import (
6+
"log"
7+
8+
hcl "github.com/hashicorp/hcl/v2"
9+
"github.com/terraform-linters/tflint-plugin-sdk/tflint"
10+
)
11+
12+
// AwsSecretsmanagerSecretPolicyInvalidPolicyRule checks the pattern is valid
13+
type AwsSecretsmanagerSecretPolicyInvalidPolicyRule struct {
14+
resourceType string
15+
attributeName string
16+
max int
17+
min int
18+
}
19+
20+
// NewAwsSecretsmanagerSecretPolicyInvalidPolicyRule returns new rule with default attributes
21+
func NewAwsSecretsmanagerSecretPolicyInvalidPolicyRule() *AwsSecretsmanagerSecretPolicyInvalidPolicyRule {
22+
return &AwsSecretsmanagerSecretPolicyInvalidPolicyRule{
23+
resourceType: "aws_secretsmanager_secret_policy",
24+
attributeName: "policy",
25+
max: 20480,
26+
min: 1,
27+
}
28+
}
29+
30+
// Name returns the rule name
31+
func (r *AwsSecretsmanagerSecretPolicyInvalidPolicyRule) Name() string {
32+
return "aws_secretsmanager_secret_policy_invalid_policy"
33+
}
34+
35+
// Enabled returns whether the rule is enabled by default
36+
func (r *AwsSecretsmanagerSecretPolicyInvalidPolicyRule) Enabled() bool {
37+
return true
38+
}
39+
40+
// Severity returns the rule severity
41+
func (r *AwsSecretsmanagerSecretPolicyInvalidPolicyRule) Severity() string {
42+
return tflint.ERROR
43+
}
44+
45+
// Link returns the rule reference link
46+
func (r *AwsSecretsmanagerSecretPolicyInvalidPolicyRule) Link() string {
47+
return ""
48+
}
49+
50+
// Check checks the pattern is valid
51+
func (r *AwsSecretsmanagerSecretPolicyInvalidPolicyRule) Check(runner tflint.Runner) error {
52+
log.Printf("[TRACE] Check `%s` rule", r.Name())
53+
54+
return runner.WalkResourceAttributes(r.resourceType, r.attributeName, func(attribute *hcl.Attribute) error {
55+
var val string
56+
err := runner.EvaluateExpr(attribute.Expr, &val, nil)
57+
58+
return runner.EnsureNoError(err, func() error {
59+
if len(val) > r.max {
60+
runner.EmitIssueOnExpr(
61+
r,
62+
"policy must be 20480 characters or less",
63+
attribute.Expr,
64+
)
65+
}
66+
if len(val) < r.min {
67+
runner.EmitIssueOnExpr(
68+
r,
69+
"policy must be 1 characters or higher",
70+
attribute.Expr,
71+
)
72+
}
73+
return nil
74+
})
75+
})
76+
}

‎rules/models/aws_secretsmanager_secret_policy_invalid_secret_arn.go

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
// This file generated by `generator/`. DO NOT EDIT
2+
3+
package models
4+
5+
import (
6+
"log"
7+
8+
hcl "github.com/hashicorp/hcl/v2"
9+
"github.com/terraform-linters/tflint-plugin-sdk/tflint"
10+
)
11+
12+
// AwsSecretsmanagerSecretPolicyInvalidSecretArnRule checks the pattern is valid
13+
type AwsSecretsmanagerSecretPolicyInvalidSecretArnRule struct {
14+
resourceType string
15+
attributeName string
16+
max int
17+
min int
18+
}
19+
20+
// NewAwsSecretsmanagerSecretPolicyInvalidSecretArnRule returns new rule with default attributes
21+
func NewAwsSecretsmanagerSecretPolicyInvalidSecretArnRule() *AwsSecretsmanagerSecretPolicyInvalidSecretArnRule {
22+
return &AwsSecretsmanagerSecretPolicyInvalidSecretArnRule{
23+
resourceType: "aws_secretsmanager_secret_policy",
24+
attributeName: "secret_arn",
25+
max: 2048,
26+
min: 1,
27+
}
28+
}
29+
30+
// Name returns the rule name
31+
func (r *AwsSecretsmanagerSecretPolicyInvalidSecretArnRule) Name() string {
32+
return "aws_secretsmanager_secret_policy_invalid_secret_arn"
33+
}
34+
35+
// Enabled returns whether the rule is enabled by default
36+
func (r *AwsSecretsmanagerSecretPolicyInvalidSecretArnRule) Enabled() bool {
37+
return true
38+
}
39+
40+
// Severity returns the rule severity
41+
func (r *AwsSecretsmanagerSecretPolicyInvalidSecretArnRule) Severity() string {
42+
return tflint.ERROR
43+
}
44+
45+
// Link returns the rule reference link
46+
func (r *AwsSecretsmanagerSecretPolicyInvalidSecretArnRule) Link() string {
47+
return ""
48+
}
49+
50+
// Check checks the pattern is valid
51+
func (r *AwsSecretsmanagerSecretPolicyInvalidSecretArnRule) Check(runner tflint.Runner) error {
52+
log.Printf("[TRACE] Check `%s` rule", r.Name())
53+
54+
return runner.WalkResourceAttributes(r.resourceType, r.attributeName, func(attribute *hcl.Attribute) error {
55+
var val string
56+
err := runner.EvaluateExpr(attribute.Expr, &val, nil)
57+
58+
return runner.EnsureNoError(err, func() error {
59+
if len(val) > r.max {
60+
runner.EmitIssueOnExpr(
61+
r,
62+
"secret_arn must be 2048 characters or less",
63+
attribute.Expr,
64+
)
65+
}
66+
if len(val) < r.min {
67+
runner.EmitIssueOnExpr(
68+
r,
69+
"secret_arn must be 1 characters or higher",
70+
attribute.Expr,
71+
)
72+
}
73+
return nil
74+
})
75+
})
76+
}

‎rules/models/aws_secretsmanager_secret_rotation_invalid_rotation_lambda_arn.go

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
// This file generated by `generator/`. DO NOT EDIT
2+
3+
package models
4+
5+
import (
6+
"log"
7+
8+
hcl "github.com/hashicorp/hcl/v2"
9+
"github.com/terraform-linters/tflint-plugin-sdk/tflint"
10+
)
11+
12+
// AwsSecretsmanagerSecretRotationInvalidRotationLambdaArnRule checks the pattern is valid
13+
type AwsSecretsmanagerSecretRotationInvalidRotationLambdaArnRule struct {
14+
resourceType string
15+
attributeName string
16+
max int
17+
}
18+
19+
// NewAwsSecretsmanagerSecretRotationInvalidRotationLambdaArnRule returns new rule with default attributes
20+
func NewAwsSecretsmanagerSecretRotationInvalidRotationLambdaArnRule() *AwsSecretsmanagerSecretRotationInvalidRotationLambdaArnRule {
21+
return &AwsSecretsmanagerSecretRotationInvalidRotationLambdaArnRule{
22+
resourceType: "aws_secretsmanager_secret_rotation",
23+
attributeName: "rotation_lambda_arn",
24+
max: 2048,
25+
}
26+
}
27+
28+
// Name returns the rule name
29+
func (r *AwsSecretsmanagerSecretRotationInvalidRotationLambdaArnRule) Name() string {
30+
return "aws_secretsmanager_secret_rotation_invalid_rotation_lambda_arn"
31+
}
32+
33+
// Enabled returns whether the rule is enabled by default
34+
func (r *AwsSecretsmanagerSecretRotationInvalidRotationLambdaArnRule) Enabled() bool {
35+
return true
36+
}
37+
38+
// Severity returns the rule severity
39+
func (r *AwsSecretsmanagerSecretRotationInvalidRotationLambdaArnRule) Severity() string {
40+
return tflint.ERROR
41+
}
42+
43+
// Link returns the rule reference link
44+
func (r *AwsSecretsmanagerSecretRotationInvalidRotationLambdaArnRule) Link() string {
45+
return ""
46+
}
47+
48+
// Check checks the pattern is valid
49+
func (r *AwsSecretsmanagerSecretRotationInvalidRotationLambdaArnRule) Check(runner tflint.Runner) error {
50+
log.Printf("[TRACE] Check `%s` rule", r.Name())
51+
52+
return runner.WalkResourceAttributes(r.resourceType, r.attributeName, func(attribute *hcl.Attribute) error {
53+
var val string
54+
err := runner.EvaluateExpr(attribute.Expr, &val, nil)
55+
56+
return runner.EnsureNoError(err, func() error {
57+
if len(val) > r.max {
58+
runner.EmitIssueOnExpr(
59+
r,
60+
"rotation_lambda_arn must be 2048 characters or less",
61+
attribute.Expr,
62+
)
63+
}
64+
return nil
65+
})
66+
})
67+
}

‎rules/models/aws_secretsmanager_secret_rotation_invalid_secret_id.go

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
// This file generated by `generator/`. DO NOT EDIT
2+
3+
package models
4+
5+
import (
6+
"log"
7+
8+
hcl "github.com/hashicorp/hcl/v2"
9+
"github.com/terraform-linters/tflint-plugin-sdk/tflint"
10+
)
11+
12+
// AwsSecretsmanagerSecretRotationInvalidSecretIDRule checks the pattern is valid
13+
type AwsSecretsmanagerSecretRotationInvalidSecretIDRule struct {
14+
resourceType string
15+
attributeName string
16+
max int
17+
min int
18+
}
19+
20+
// NewAwsSecretsmanagerSecretRotationInvalidSecretIDRule returns new rule with default attributes
21+
func NewAwsSecretsmanagerSecretRotationInvalidSecretIDRule() *AwsSecretsmanagerSecretRotationInvalidSecretIDRule {
22+
return &AwsSecretsmanagerSecretRotationInvalidSecretIDRule{
23+
resourceType: "aws_secretsmanager_secret_rotation",
24+
attributeName: "secret_id",
25+
max: 2048,
26+
min: 1,
27+
}
28+
}
29+
30+
// Name returns the rule name
31+
func (r *AwsSecretsmanagerSecretRotationInvalidSecretIDRule) Name() string {
32+
return "aws_secretsmanager_secret_rotation_invalid_secret_id"
33+
}
34+
35+
// Enabled returns whether the rule is enabled by default
36+
func (r *AwsSecretsmanagerSecretRotationInvalidSecretIDRule) Enabled() bool {
37+
return true
38+
}
39+
40+
// Severity returns the rule severity
41+
func (r *AwsSecretsmanagerSecretRotationInvalidSecretIDRule) Severity() string {
42+
return tflint.ERROR
43+
}
44+
45+
// Link returns the rule reference link
46+
func (r *AwsSecretsmanagerSecretRotationInvalidSecretIDRule) Link() string {
47+
return ""
48+
}
49+
50+
// Check checks the pattern is valid
51+
func (r *AwsSecretsmanagerSecretRotationInvalidSecretIDRule) Check(runner tflint.Runner) error {
52+
log.Printf("[TRACE] Check `%s` rule", r.Name())
53+
54+
return runner.WalkResourceAttributes(r.resourceType, r.attributeName, func(attribute *hcl.Attribute) error {
55+
var val string
56+
err := runner.EvaluateExpr(attribute.Expr, &val, nil)
57+
58+
return runner.EnsureNoError(err, func() error {
59+
if len(val) > r.max {
60+
runner.EmitIssueOnExpr(
61+
r,
62+
"secret_id must be 2048 characters or less",
63+
attribute.Expr,
64+
)
65+
}
66+
if len(val) < r.min {
67+
runner.EmitIssueOnExpr(
68+
r,
69+
"secret_id must be 1 characters or higher",
70+
attribute.Expr,
71+
)
72+
}
73+
return nil
74+
})
75+
})
76+
}

‎rules/models/mappings/secretsmanager.hcl

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,17 @@ mapping "aws_secretsmanager_secret" {
1212
tags = TagListType
1313
}
1414

15+
mapping "aws_secretsmanager_secret_policy" {
16+
policy = NonEmptyResourcePolicyType
17+
secret_arn = SecretIdType
18+
}
19+
20+
mapping "aws_secretsmanager_secret_rotation" {
21+
secret_id = SecretIdType
22+
rotation_lambda_arn = RotationLambdaARNType
23+
rotation_rules = RotationRulesType
24+
}
25+
1526
mapping "aws_secretsmanager_secret_version" {
1627
secret_id = SecretIdType
1728
secret_string = SecretStringType

‎rules/models/provider.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1040,6 +1040,10 @@ var Rules = []tflint.Rule{
10401040
NewAwsSecretsmanagerSecretInvalidNameRule(),
10411041
NewAwsSecretsmanagerSecretInvalidPolicyRule(),
10421042
NewAwsSecretsmanagerSecretInvalidRotationLambdaArnRule(),
1043+
NewAwsSecretsmanagerSecretPolicyInvalidPolicyRule(),
1044+
NewAwsSecretsmanagerSecretPolicyInvalidSecretArnRule(),
1045+
NewAwsSecretsmanagerSecretRotationInvalidRotationLambdaArnRule(),
1046+
NewAwsSecretsmanagerSecretRotationInvalidSecretIDRule(),
10431047
NewAwsSecretsmanagerSecretVersionInvalidSecretIDRule(),
10441048
NewAwsSecretsmanagerSecretVersionInvalidSecretStringRule(),
10451049
NewAwsSecurityhubActionTargetInvalidDescriptionRule(),

0 commit comments

Comments
 (0)