diff --git a/.automation/test/terraform/good/terraform_good_1.tf b/.automation/test/terraform/good/terraform_good_1.tf index 59d24f7e..330a28bf 100644 --- a/.automation/test/terraform/good/terraform_good_1.tf +++ b/.automation/test/terraform/good/terraform_good_1.tf @@ -3,6 +3,8 @@ resource "aws_instance" "good" { instance_type = "t2.small" associate_public_ip_address = false + vpc_security_group_ids = ["sg-12345678901234567"] + ebs_block_device { encrypted = true } diff --git a/.automation/test/terraform_terrascan/bad/terraform_bad_1.tf b/.automation/test/terraform_terrascan/bad/terraform_bad_1.tf index 57b891dc..2b2788b1 100644 --- a/.automation/test/terraform_terrascan/bad/terraform_bad_1.tf +++ b/.automation/test/terraform_terrascan/bad/terraform_bad_1.tf @@ -1,9 +1,8 @@ -resource "aws_instance" "bad" { - ami = "ami-0ff8a91507f77f867" - instance_type = "t2.small" - associate_public_ip_address = true +resource "aws_instance" "instanceWithNoVpc" { + ami = "some-id" + instance_type = "t2.micro" - ebs_block_device { - encrypted = true + tags = { + Name = "HelloWorld" } } diff --git a/.automation/test/terraform_terrascan/good/terraform_good_1.tf b/.automation/test/terraform_terrascan/good/terraform_good_1.tf index 59d24f7e..7d4e8853 100644 --- a/.automation/test/terraform_terrascan/good/terraform_good_1.tf +++ b/.automation/test/terraform_terrascan/good/terraform_good_1.tf @@ -1,9 +1,11 @@ -resource "aws_instance" "good" { - ami = "ami-0ff8a91507f77f867" - instance_type = "t2.small" - associate_public_ip_address = false +resource "aws_instance" "instanceWithVpc" { + ami = "some-id" + instance_type = "t2.micro" - ebs_block_device { - encrypted = true + vpc_security_group_ids = ["sg-12345678901234567"] + subnet_id = "subnet-12345678901234567" + + tags = { + Name = "HelloWorld" } } diff --git a/Dockerfile b/Dockerfile index a7cead71..0c0d032a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -14,6 +14,7 @@ FROM golangci/golangci-lint:v1.30.0 as golangci-lint FROM yoheimuta/protolint:v0.26.0 as protolint FROM koalaman/shellcheck:v0.7.1 as shellcheck FROM wata727/tflint:0.19.1 as tflint +FROM accurics/terrascan:latest as terrascan FROM hadolint/hadolint:latest-alpine as dockerfile-lint FROM assignuser/lintr-lib:v0.1.0 as lintr-lib FROM assignuser/chktex-alpine:v0.1.0 as chktex @@ -166,6 +167,13 @@ COPY --from=golangci-lint /usr/bin/golangci-lint /usr/bin/ ################## COPY --from=tflint /usr/local/bin/tflint /usr/bin/ +################## +# Install Terrascan # +################## +COPY --from=terrascan /go/bin/terrascan /usr/bin/ +RUN terrascan init + + ###################### # Install protolint # ###################### diff --git a/README.md b/README.md index a1596190..33d5d34c 100644 --- a/README.md +++ b/README.md @@ -236,7 +236,7 @@ But if you wish to select or exclude specific linters, we give you full control | **VALIDATE_STATES** | `true` | Flag to enable or disable the linting process for AWS States Language. | | **VALIDATE_SQL** | `true` | Flag to enable or disable the linting process of the SQL language. | | **VALIDATE_TERRAFORM** | `true` | Flag to enable or disable the linting process of the Terraform language. | -| **VALIDATE_TERRAFORM_TERRASCAN** | `false` | Flag to enable or disable the linting process of the Terraform language for security related issues. | +| **VALIDATE_TERRAFORM_TERRASCAN** | `true` | Flag to enable or disable the linting process of the Terraform language for security related issues. | | **VALIDATE_TSX** | `true` | Flag to enable or disable the linting process for tsx files (Utilizing: eslint) | | **VALIDATE_TYPESCRIPT_ES** | `true` | Flag to enable or disable the linting process of the Typescript language. (Utilizing: eslint) | | **VALIDATE_TYPESCRIPT_STANDARD** | `true` | Flag to enable or disable the linting process of the Typescript language. (Utilizing: standard) | diff --git a/dependencies/Pipfile b/dependencies/Pipfile index ffe213f6..a935ed23 100644 --- a/dependencies/Pipfile +++ b/dependencies/Pipfile @@ -10,7 +10,6 @@ black = "*" cfn-lint = "*" flake8 = "*" pylint = "*" -terrascan = "*" yamllint = "*" yq = "*" diff --git a/dependencies/Pipfile.lock b/dependencies/Pipfile.lock index 2860725e..c18d862b 100644 --- a/dependencies/Pipfile.lock +++ b/dependencies/Pipfile.lock @@ -307,14 +307,6 @@ ], "version": "==1.15.0" }, - "terrascan": { - "hashes": [ - "sha256:2003638e2e38feba9215df3add2ee99565731b86dbd5c43fd8982b1a4ddac927", - "sha256:b44d8c7eac96aa8094865061783ab0e8e849690b8187b75778caf5dd34002d18" - ], - "index": "pypi", - "version": "==0.2.3" - }, "toml": { "hashes": [ "sha256:926b612be1e5ce0634a2ca03470f95169cf16f939018233a670519cb4ac58b0f", diff --git a/lib/linter.sh b/lib/linter.sh index 5f3dd8a2..2f7fa548 100755 --- a/lib/linter.sh +++ b/lib/linter.sh @@ -1869,7 +1869,7 @@ if [ "${VALIDATE_TERRAFORM_TERRASCAN}" == "true" ]; then # Lint the Terraform files # ############################ # LintCodebase "FILE_TYPE" "LINTER_NAME" "LINTER_CMD" "FILE_TYPES_REGEX" "FILE_ARRAY" - LintCodebase "TERRAFORM_TERRASCAN" "terrascan" "terrascan -f " ".*\.\(tf\)\$" "${FILE_ARRAY_TERRAFORM_TERRASCAN[@]}" + LintCodebase "TERRAFORM_TERRASCAN" "terrascan" "terrascan scan -p /root/.terrascan/pkg/policies/opa/rego/ -t aws -f " ".*\.\(tf\)\$" "${FILE_ARRAY_TERRAFORM_TERRASCAN[@]}" fi ############### diff --git a/lib/worker.sh b/lib/worker.sh index 53bfc825..16f0a8ba 100755 --- a/lib/worker.sh +++ b/lib/worker.sh @@ -651,7 +651,7 @@ function RunTestCases() { TestCodebase "STATES" "asl-validator" "asl-validator --json-path" ".*\.\(json\)\$" "states" TestCodebase "SQL" "sql-lint" "sql-lint --config ${SQL_LINTER_RULES}" ".*\.\(sql\)\$" "sql" TestCodebase "TERRAFORM" "tflint" "tflint -c ${TERRAFORM_LINTER_RULES}" ".*\.\(tf\)\$" "terraform" - TestCodebase "TERRAFORM_TERRASCAN" "terrascan" "terrascan -f" ".*\.\(tf\)\$" "terraform_terrascan" + TestCodebase "TERRAFORM_TERRASCAN" "terrascan" "terrascan scan -p /root/.terrascan/pkg/policies/opa/rego/ -t aws -f " ".*\.\(tf\)\$" "terraform_terrascan" TestCodebase "TYPESCRIPT_ES" "eslint" "eslint --no-eslintrc -c ${TYPESCRIPT_LINTER_RULES}" ".*\.\(ts\)\$" "typescript" TestCodebase "TYPESCRIPT_STANDARD" "standard" "standard --parser @typescript-eslint/parser --plugin @typescript-eslint/eslint-plugin ${TYPESCRIPT_STANDARD_LINTER_RULES}" ".*\.\(ts\)\$" "typescript" TestCodebase "XML" "xmllint" "xmllint" ".*\.\(xml\)\$" "xml"