Skip to content

Instantly share code, notes, and snippets.

@myoung34

myoung34/output

Created April 24, 2020 19:18
Show Gist options
  • Save myoung34/311aa6760b0f4b7d3e52952ba5210033 to your computer and use it in GitHub Desktop.
Save myoung34/311aa6760b0f4b7d3e52952ba5210033 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
output
$ cat tfplan.json | conftest test -
FAIL - (policy/rds_create.rego) Minimum RDS Tags not set. Must include: ["managed_by", "environment", "team"]
FAIL - (policy/rds_update.rego) Minimum RDS Tags not set. Must include: ["managed_by", "environment", "team"]
2 tests, 0 passed, 0 warnings, 2 failures
Raw
rds.tf
provider "aws" {
region = "us-east-1"
version = "~> 2.30"
}
resource "aws_db_instance" "default" {
allocated_storage = 20
storage_type = "gp2"
engine = "mysql"
engine_version = "5.7"
instance_class = "db.t2.micro"
name = "mydb"
username = "foo"
password = "foobarbaz"
parameter_group_name = "default.mysql5.7"
}
Raw
rds_create.rego
package main
import input as tfplan
resource_types = {"aws_db_instance"}
minimum_tags = min_created_tags {
some resource_type
min_created_tags := created_tags[resource_type]
}
contains(arr, i) {
arr[_] = i
}
tags_contain_proper_keys(tags) = true {
contains(tags, "environment")
contains(tags, "managed_by")
contains(tags, "team")
} else = false { true }
created_tags[resource_type] = num {
some resource_type
resource_types[resource_type]
all := resources[resource_type]
create_resources := [res | res:= all[_]; res.change.actions[_] == "create"]
tag_changeset := [res | res := [key | create_resources[_].change.after.tags[key]]]
num := tags_contain_proper_keys(tag_changeset[_])
}
resources[resource_type] = all {
some resource_type
resource_types[resource_type]
all := [name |
name:= tfplan.resource_changes[_]
name.type == resource_type
]
}
deny["(policy/rds_create.rego) Minimum RDS Tags not set. Must include: [\"managed_by\", \"environment\", \"team\"]"] {
minimum_tags == false
}
Raw
rds_update.rego
package main
import input as tfplan
resource_types = {"aws_db_instance"}
minimum_tags = min_updated_tags {
some resource_type
min_updated_tags := updated_tags[resource_type]
}
contains(arr, i) {
arr[_] = i
}
tags_contain_proper_keys(tags) = true {
contains(tags, "environment")
contains(tags, "managed_by")
contains(tags, "team")
} else = false { true }
updated_tags[resource_type] = num {
some resource_type
resource_types[resource_type]
all := resources[resource_type]
update_resources := [res | res:= all[_]; res.change.actions[_] == "update"]
tag_changeset := [res | res := [key | update_resources[_].change.after.tags[key]]]
num := tags_contain_proper_keys(tag_changeset[_])
}
resources[resource_type] = all {
some resource_type
resource_types[resource_type]
all := [name |
name:= tfplan.resource_changes[_]
name.type == resource_type
]
}
deny["(policy/rds_update.rego) Minimum RDS Tags not set. Must include: [\"managed_by\", \"environment\", \"team\"]"] {
minimum_tags == false
}
Raw
tfplan.json
{
"format_version": "0.1",
"terraform_version": "0.12.20",
"planned_values": {
"root_module": {
"resources": [
{
"address": "aws_db_instance.default",
"mode": "managed",
"type": "aws_db_instance",
"name": "default",
"provider_name": "aws",
"schema_version": 1,
"values": {
"allocated_storage": 20,
"allow_major_version_upgrade": null,
"auto_minor_version_upgrade": true,
"copy_tags_to_snapshot": false,
"delete_automated_backups": true,
"deletion_protection": null,
"domain": null,
"domain_iam_role_name": null,
"enabled_cloudwatch_logs_exports": null,
"engine": "mysql",
"engine_version": "5.7",
"final_snapshot_identifier": null,
"iam_database_authentication_enabled": null,
"instance_class": "db.t2.micro",
"iops": null,
"max_allocated_storage": null,
"monitoring_interval": 0,
"name": "mydb",
"parameter_group_name": "default.mysql5.7",
"password": "foobarbaz",
"performance_insights_enabled": false,
"publicly_accessible": false,
"replicate_source_db": null,
"s3_import": [],
"security_group_names": null,
"skip_final_snapshot": false,
"snapshot_identifier": null,
"storage_encrypted": null,
"storage_type": "gp2",
"tags": null,
"timeouts": null,
"username": "foo"
}
}
]
}
},
"resource_changes": [
{
"address": "aws_db_instance.default",
"mode": "managed",
"type": "aws_db_instance",
"name": "default",
"provider_name": "aws",
"change": {
"actions": [
"create"
],
"before": null,
"after": {
"allocated_storage": 20,
"allow_major_version_upgrade": null,
"auto_minor_version_upgrade": true,
"copy_tags_to_snapshot": false,
"delete_automated_backups": true,
"deletion_protection": null,
"domain": null,
"domain_iam_role_name": null,
"enabled_cloudwatch_logs_exports": null,
"engine": "mysql",
"engine_version": "5.7",
"final_snapshot_identifier": null,
"iam_database_authentication_enabled": null,
"instance_class": "db.t2.micro",
"iops": null,
"max_allocated_storage": null,
"monitoring_interval": 0,
"name": "mydb",
"parameter_group_name": "default.mysql5.7",
"password": "foobarbaz",
"performance_insights_enabled": false,
"publicly_accessible": false,
"replicate_source_db": null,
"s3_import": [],
"security_group_names": null,
"skip_final_snapshot": false,
"snapshot_identifier": null,
"storage_encrypted": null,
"storage_type": "gp2",
"tags": null,
"timeouts": null,
"username": "foo"
},
"after_unknown": {
"address": true,
"apply_immediately": true,
"arn": true,
"availability_zone": true,
"backup_retention_period": true,
"backup_window": true,
"ca_cert_identifier": true,
"character_set_name": true,
"db_subnet_group_name": true,
"endpoint": true,
"hosted_zone_id": true,
"id": true,
"identifier": true,
"identifier_prefix": true,
"kms_key_id": true,
"license_model": true,
"maintenance_window": true,
"monitoring_role_arn": true,
"multi_az": true,
"option_group_name": true,
"performance_insights_kms_key_id": true,
"performance_insights_retention_period": true,
"port": true,
"replicas": true,
"resource_id": true,
"s3_import": [],
"status": true,
"timezone": true,
"vpc_security_group_ids": true
}
}
}
],
"configuration": {
"provider_config": {
"aws": {
"name": "aws",
"version_constraint": "~> 2.30",
"expressions": {
"region": {
"constant_value": "us-east-1"
}
}
}
},
"root_module": {
"resources": [
{
"address": "aws_db_instance.default",
"mode": "managed",
"type": "aws_db_instance",
"name": "default",
"provider_config_key": "aws",
"expressions": {
"allocated_storage": {
"constant_value": 20
},
"engine": {
"constant_value": "mysql"
},
"engine_version": {
"constant_value": "5.7"
},
"instance_class": {
"constant_value": "db.t2.micro"
},
"name": {
"constant_value": "mydb"
},
"parameter_group_name": {
"constant_value": "default.mysql5.7"
},
"password": {
"constant_value": "foobarbaz"
},
"storage_type": {
"constant_value": "gp2"
},
"username": {
"constant_value": "foo"
}
},
"schema_version": 1
}
]
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment