Skip to content

Commit 0f5a9b4

Browse files
author
IA Automator
committed
initial commit
0 parents  commit 0f5a9b4

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

50 files changed

+1129
-0
lines changed

‎.config/.checkov.yml

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
download-external-modules: False
2+
evaluate-variables: true
3+
directory:
4+
- ./
5+
framework:
6+
- terraform
7+
skip-check:
8+
- CKV2_GCP*
9+
- CKV_AZURE*
10+
- CKV2_AZURE*
11+
- CKV_TF_1 # default to Terraform registry instead of Git
12+
summary-position: bottom
13+
output: 'cli'
14+
compact: True
15+
quiet: True

‎.config/.mdlrc

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Ignoring the following rules
2+
# MD007 Unordered list indentation
3+
# MD013 Line length
4+
# MD029 Ordered list item prefix
5+
rules "~MD007", "~MD013", "~MD029"

‎.config/.terraform-docs.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
formatter: markdown
2+
header-from: .header.md
3+
settings:
4+
anchor: true
5+
color: true
6+
default: true
7+
escape: true
8+
html: true
9+
indent: 2
10+
required: true
11+
sensitive: true
12+
type: true
13+
14+
sort:
15+
enabled: true
16+
by: required
17+
18+
output:
19+
file: README.md
20+
mode: replace

‎.config/.tflint.hcl

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# https://github.com/terraform-linters/tflint/blob/master/docs/user-guide/module-inspection.md
2+
# borrowed & modified indefinitely from https://github.com/ksatirli/building-infrastructure-you-can-mostly-trust/blob/main/.tflint.hcl
3+
4+
plugin "aws" {
5+
enabled = true
6+
version = "0.22.1"
7+
source = "github.com/terraform-linters/tflint-ruleset-aws"
8+
}
9+
10+
config {
11+
module = true
12+
force = false
13+
}
14+
15+
rule "terraform_required_providers" {
16+
enabled = true
17+
}
18+
19+
rule "terraform_required_version" {
20+
enabled = true
21+
}
22+
23+
rule "terraform_naming_convention" {
24+
enabled = true
25+
format = "snake_case"
26+
}
27+
28+
rule "terraform_typed_variables" {
29+
enabled = true
30+
}
31+
32+
rule "terraform_unused_declarations" {
33+
enabled = true
34+
}
35+
36+
rule "terraform_comment_syntax" {
37+
enabled = true
38+
}
39+
40+
rule "terraform_deprecated_index" {
41+
enabled = true
42+
}
43+
44+
rule "terraform_deprecated_interpolation" {
45+
enabled = true
46+
}
47+
48+
rule "terraform_documented_outputs" {
49+
enabled = true
50+
}
51+
52+
rule "terraform_documented_variables" {
53+
enabled = true
54+
}
55+
56+
rule "terraform_module_pinned_source" {
57+
enabled = true
58+
}
59+
60+
rule "terraform_standard_module_structure" {
61+
enabled = true
62+
}
63+
64+
rule "terraform_workspace_remote" {
65+
enabled = true
66+
}

‎.config/.tfsec.yml

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
{
2+
"minimum_severity": "MEDIUM"
3+
}

‎.config/.tfsec/launch_configuration_imdsv2_tfchecks.json

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
{
2+
"checks": [
3+
{
4+
"code": "CUS002",
5+
"description": "Check to IMDSv2 is required on EC2 instances created by this Launch Template",
6+
"impact": "Instance metadata service can be interacted with freely",
7+
"resolution": "Enable HTTP token requirement for IMDS",
8+
"requiredTypes": [
9+
"resource"
10+
],
11+
"requiredLabels": [
12+
"aws_launch_configuration"
13+
],
14+
"severity": "CRITICAL",
15+
"matchSpec": {
16+
"action": "isPresent",
17+
"name": "metadata_options",
18+
"subMatch": {
19+
"action": "and",
20+
"predicateMatchSpec": [
21+
{
22+
"action": "equals",
23+
"name": "http_tokens",
24+
"value": "required"
25+
26+
}
27+
]
28+
}
29+
},
30+
31+
"errorMessage": "is missing `metadata_options` block - it is required with `http_tokens` set to `required` to make Instance Metadata Service more secure.",
32+
"relatedLinks": [
33+
"https://tfsec.dev/docs/aws/ec2/enforce-http-token-imds#aws/ec2",
34+
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_configuration#metadata-options",
35+
"https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service"
36+
]
37+
}
38+
]
39+
}

‎.config/.tfsec/launch_template_imdsv2_tfchecks.json

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
{
2+
"checks": [
3+
{
4+
"code": "CUS001",
5+
"description": "Check to IMDSv2 is required on EC2 instances created by this Launch Template",
6+
"impact": "Instance metadata service can be interacted with freely",
7+
"resolution": "Enable HTTP token requirement for IMDS",
8+
"requiredTypes": [
9+
"resource"
10+
],
11+
"requiredLabels": [
12+
"aws_launch_template"
13+
],
14+
"severity": "CRITICAL",
15+
"matchSpec": {
16+
"action": "isPresent",
17+
"name": "metadata_options",
18+
"subMatch": {
19+
"action": "and",
20+
"predicateMatchSpec": [
21+
{
22+
"action": "equals",
23+
"name": "http_tokens",
24+
"value": "required"
25+
26+
}
27+
]
28+
}
29+
},
30+
31+
"errorMessage": "is missing `metadata_options` block - it is required with `http_tokens` set to `required` to make Instance Metadata Service more secure.",
32+
"relatedLinks": [
33+
"https://tfsec.dev/docs/aws/ec2/enforce-http-token-imds#aws/ec2",
34+
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template#metadata-options",
35+
"https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service"
36+
]
37+
}
38+
]
39+
}

‎.config/.tfsec/no_launch_config_tfchecks.json

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"checks": [
3+
{
4+
"code": "CUS003",
5+
"description": "Use `aws_launch_template` over `aws_launch_configuration",
6+
"impact": "Launch configurations are not capable of versions",
7+
"resolution": "Convert resource type and attributes to `aws_launch_template`",
8+
"requiredTypes": [
9+
"resource"
10+
],
11+
"requiredLabels": [
12+
"aws_launch_configuration"
13+
],
14+
"severity": "MEDIUM",
15+
"matchSpec": {
16+
"action": "notPresent",
17+
"name": "image_id"
18+
},
19+
20+
"errorMessage": "should be changed to `aws_launch_template` since the functionality is the same but templates can be versioned.",
21+
"relatedLinks": [
22+
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template",
23+
"https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service"
24+
]
25+
}
26+
]
27+
}

‎.config/.tfsec/sg_no_embedded_egress_rules_tfchecks.json

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"checks": [
3+
{
4+
"code": "CUS005",
5+
"description": "Security group rules should be defined with `aws_security_group_rule` instead of embedded.",
6+
"impact": "Embedded security group rules can cause issues during configuration updates.",
7+
"resolution": "Move `egress` rules to `aws_security_group_rule` and attach to `aws_security_group`.",
8+
"requiredTypes": [
9+
"resource"
10+
],
11+
"requiredLabels": [
12+
"aws_security_group"
13+
],
14+
"severity": "MEDIUM",
15+
"matchSpec": {
16+
"action": "notPresent",
17+
"name": "egress"
18+
},
19+
20+
"errorMessage": "`egress` rules should be moved to `aws_security_group_rule` and attached to `aws_security_group` instead of embedded.",
21+
"relatedLinks": [
22+
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule",
23+
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group"
24+
]
25+
}
26+
]
27+
}

‎.config/.tfsec/sg_no_embedded_ingress_rules_tfchecks.json

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"checks": [
3+
{
4+
"code": "CUS004",
5+
"description": "Security group rules should be defined with `aws_security_group_rule` instead of embedded.",
6+
"impact": "Embedded security group rules can cause issues during configuration updates.",
7+
"resolution": "Move `ingress` rules to `aws_security_group_rule` and attach to `aws_security_group`.",
8+
"requiredTypes": [
9+
"resource"
10+
],
11+
"requiredLabels": [
12+
"aws_security_group"
13+
],
14+
"severity": "MEDIUM",
15+
"matchSpec": {
16+
"action": "notPresent",
17+
"name": "ingress"
18+
},
19+
20+
"errorMessage": "`ingress` rules should be moved to `aws_security_group_rule` and attached to `aws_security_group` instead of embedded.",
21+
"relatedLinks": [
22+
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule",
23+
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group"
24+
]
25+
}
26+
]
27+
}

‎.config/functional_tests/post-entrypoint-helpers.sh

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/bash
2+
## NOTE: this script runs at the end of functional test
3+
## Use this to load any configurations after the functional test
4+
## TIPS: avoid modifying the .project_automation/functional_test/entrypoint.sh
5+
## migrate any customization you did on entrypoint.sh to this helper script
6+
echo "Executing Post-Entrypoint Helpers"

‎.config/functional_tests/pre-entrypoint-helpers.sh

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/bash
2+
## NOTE: this script runs at the start of functional test
3+
## use this to load any configuration before the functional test
4+
## TIPS: avoid modifying the .project_automation/functional_test/entrypoint.sh
5+
## migrate any customization you did on entrypoint.sh to this helper script
6+
echo "Executing Pre-Entrypoint Helpers"

‎.config/static_tests/post-entrypoint-helpers.sh

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/bash
2+
## NOTE: this script runs at the end of static test
3+
## Use this to load any configurations after the static test
4+
## TIPS: avoid modifying the .project_automation/static_test/entrypoint.sh
5+
## migrate any customization you did on entrypoint.sh to this helper script
6+
echo "Executing Post-Entrypoint Helpers"

‎.config/static_tests/pre-entrypoint-helpers.sh

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/bash
2+
## NOTE: this script runs at the start of static test
3+
## use this to load any configuration before the static test
4+
## TIPS: avoid modifying the .project_automation/static_test/entrypoint.sh
5+
## migrate any customization you did on entrypoint.sh to this helper script
6+
echo "Executing Pre-Entrypoint Helpers"

‎.copier-answers.yml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# This file is auto-generated, changes will be overwritten
2+
_commit: v0.1.4
3+
_src_path: /task/5fb04518-3f98-11ef-99b5-ee50a2171c8f/projecttype
4+
starting_version: v0.0.0
5+
version_file: VERSION
6+

‎.gitignore

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
build/
2+
plan.out
3+
plan.out.json
4+
5+
# Local .terraform directories
6+
**/.terraform/*
7+
8+
# .tfstate files
9+
*.tfstate
10+
*.tfstate.*
11+
12+
# Crash log files
13+
crash.log
14+
15+
# Exclude all .tfvars files, which are likely to contain sentitive data, such as
16+
# password, private keys, and other secrets. These should not be part of version
17+
# control as they are data points which are potentially sensitive and subject
18+
# to change depending on the environment.
19+
#
20+
*.tfvars
21+
22+
# Ignore override files as they are usually used to override resources locally and so
23+
# are not checked in
24+
override.tf
25+
override.tf.json
26+
*_override.tf
27+
*_override.tf.json
28+
29+
# Include override files you do wish to add to version control using negated pattern
30+
#
31+
# !example_override.tf
32+
33+
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
34+
# example: *tfplan*
35+
36+
# Ignore CLI configuration files
37+
.terraformrc
38+
terraform.rc
39+
.terraform.lock.hcl
40+
41+
# Terratest / GoLang
42+
go.mod
43+
go.sum
44+
45+
# Terraform tests
46+
tests/*.auto.tfvars

‎.header.md

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# Terraform Module Project
2+
3+
:no_entry_sign: Do not edit this readme.md file. To learn how to change this content and work with this repository, refer to CONTRIBUTING.md
4+
5+
## Readme Content
6+
7+
This file will contain any instructional information about this module.

‎.pre-commit-config.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
fail_fast: false
3+
minimum_pre_commit_version: "2.6.0"
4+
repos:
5+
-
6+
repo: https://github.com/terraform-docs/terraform-docs
7+
# To update run:
8+
# pre-commit autoupdate --freeze
9+
rev: 212db41760d7fc45d736d5eb94a483d0d2a12049 # frozen: v0.16.0
10+
hooks:
11+
- id: terraform-docs-go
12+
args:
13+
- "--config=.config/.terraform-docs.yaml"
14+
- "--lockfile=false"
15+
- "--recursive"
16+
- "--recursive-path=examples/"
17+
- "./"

0 commit comments

Comments
 (0)