Skip to content

Commit 133698b

Browse files
author
Ben Fortuna
committed
Added checkov static analysis
1 parent 47a9712 commit 133698b

File tree

2 files changed

+55
-33
lines changed

2 files changed

+55
-33
lines changed

‎Makefile‎

Lines changed: 50 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,49 +1,66 @@
11
SHELL:=/bin/bash
22
TERRAFORM_VERSION=0.12.24
3-
TERRAFORM=docker run --rm -v "${PWD}:/work" -v "${HOME}:/root" -e AWS_DEFAULT_REGION=$(AWS_DEFAULT_REGION) -e http_proxy=$(http_proxy) --net=host -w /work hashicorp/terraform:$(TERRAFORM_VERSION)
3+
TERRAFORM=docker run --rm -v "${PWD}:/work" -e AWS_DEFAULT_REGION=$(AWS_DEFAULT_REGION) -e http_proxy=$(http_proxy) --net=host -w /work hashicorp/terraform:$(TERRAFORM_VERSION)
44

5-
.PHONY: all clean test docs format
5+
TERRAFORM_DOCS=docker run --rm -v "${PWD}:/work" tmknom/terraform-docs
66

7-
all: test docs format
7+
CHECKOV=docker run -t -v "${PWD}:/work" bridgecrew/checkov
8+
9+
.PHONY: all clean validate test docs format
10+
11+
all: validate test docs format
812

913
clean:
1014
rm -rf .terraform/
1115

12-
test:
16+
validate:
1317
$(TERRAFORM) init && $(TERRAFORM) validate && \
14-
$(TERRAFORM) init modules/cloudfront-request-rewrite && $(TERRAFORM) validate modules/cloudfront-request-rewrite
15-
$(TERRAFORM) init modules/dynamodb-table-import && $(TERRAFORM) validate modules/dynamodb-table-import
16-
$(TERRAFORM) init modules/dynamodb-table-put && $(TERRAFORM) validate modules/dynamodb-table-put
17-
$(TERRAFORM) init modules/ec2-ami-deletion && $(TERRAFORM) validate modules/ec2-ami-deletion
18-
$(TERRAFORM) init modules/ec2-instance-cycle && $(TERRAFORM) validate modules/ec2-instance-cycle
19-
$(TERRAFORM) init modules/iam-user-keyrotation && $(TERRAFORM) validate modules/iam-user-keyrotation
20-
$(TERRAFORM) init modules/rds-cluster-cycle && $(TERRAFORM) validate modules/rds-cluster-cycle
21-
$(TERRAFORM) init modules/rds-cluster-snapshot && $(TERRAFORM) validate modules/rds-cluster-snapshot
22-
$(TERRAFORM) init modules/rds-instance-cycle && $(TERRAFORM) validate modules/rds-instance-cycle
18+
$(TERRAFORM) init modules/cloudfront-request-rewrite && $(TERRAFORM) validate modules/cloudfront-request-rewrite && \
19+
$(TERRAFORM) init modules/dynamodb-table-import && $(TERRAFORM) validate modules/dynamodb-table-import && \
20+
$(TERRAFORM) init modules/dynamodb-table-put && $(TERRAFORM) validate modules/dynamodb-table-put && \
21+
$(TERRAFORM) init modules/ec2-ami-deletion && $(TERRAFORM) validate modules/ec2-ami-deletion && \
22+
$(TERRAFORM) init modules/ec2-instance-cycle && $(TERRAFORM) validate modules/ec2-instance-cycle && \
23+
$(TERRAFORM) init modules/iam-user-keyrotation && $(TERRAFORM) validate modules/iam-user-keyrotation && \
24+
$(TERRAFORM) init modules/rds-cluster-cycle && $(TERRAFORM) validate modules/rds-cluster-cycle && \
25+
$(TERRAFORM) init modules/rds-cluster-snapshot && $(TERRAFORM) validate modules/rds-cluster-snapshot && \
26+
$(TERRAFORM) init modules/rds-instance-cycle && $(TERRAFORM) validate modules/rds-instance-cycle && \
2327
$(TERRAFORM) init modules/rds-instance-snapshot && $(TERRAFORM) validate modules/rds-instance-snapshot
2428

29+
test: validate
30+
$(CHECKOV) -d /work && \
31+
$(CHECKOV) -d /work/modules/cloudfront-request-rewrite && \
32+
$(CHECKOV) -d /work/modules/dynamodb-table-import && \
33+
$(CHECKOV) -d /work/modules/dynamodb-table-put && \
34+
$(CHECKOV) -d /work/modules/ec2-ami-deletion && \
35+
$(CHECKOV) -d /work/modules/ec2-instance-cycle && \
36+
$(CHECKOV) -d /work/modules/iam-user-keyrotation && \
37+
$(CHECKOV) -d /work/modules/rds-cluster-cycle && \
38+
$(CHECKOV) -d /work/modules/rds-cluster-snapshot && \
39+
$(CHECKOV) -d /work/modules/rds-instance-cycle && \
40+
$(CHECKOV) -d /work/modules/rds-instance-snapshot
41+
2542
docs:
26-
docker run --rm -v "${PWD}:/work" tmknom/terraform-docs markdown ./ >./README.md && \
27-
docker run --rm -v "${PWD}:/work" tmknom/terraform-docs markdown ./modules/cloudfront-request-rewrite >./modules/cloudfront-request-rewrite/README.md
28-
docker run --rm -v "${PWD}:/work" tmknom/terraform-docs markdown ./modules/dynamodb-table-import >./modules/dynamodb-table-import/README.md
29-
docker run --rm -v "${PWD}:/work" tmknom/terraform-docs markdown ./modules/dynamodb-table-put >./modules/dynamodb-table-put/README.md
30-
docker run --rm -v "${PWD}:/work" tmknom/terraform-docs markdown ./modules/ec2-ami-deletion >./modules/ec2-ami-deletion/README.md
31-
docker run --rm -v "${PWD}:/work" tmknom/terraform-docs markdown ./modules/ec2-instance-cycle >./modules/ec2-instance-cycle/README.md
32-
docker run --rm -v "${PWD}:/work" tmknom/terraform-docs markdown ./modules/iam-user-keyrotation >./modules/iam-user-keyrotation/README.md
33-
docker run --rm -v "${PWD}:/work" tmknom/terraform-docs markdown ./modules/rds-cluster-cycle >./modules/rds-cluster-cycle/README.md
34-
docker run --rm -v "${PWD}:/work" tmknom/terraform-docs markdown ./modules/rds-cluster-snapshot >./modules/rds-cluster-snapshot/README.md
35-
docker run --rm -v "${PWD}:/work" tmknom/terraform-docs markdown ./modules/rds-instance-cycle >./modules/rds-instance-cycle/README.md
36-
docker run --rm -v "${PWD}:/work" tmknom/terraform-docs markdown ./modules/rds-instance-snapshot >./modules/rds-instance-snapshot/README.md
43+
$(TERRAFORM_DOCS) markdown ./ >./README.md && \
44+
$(TERRAFORM_DOCS) markdown ./modules/cloudfront-request-rewrite >./modules/cloudfront-request-rewrite/README.md && \
45+
$(TERRAFORM_DOCS) markdown ./modules/dynamodb-table-import >./modules/dynamodb-table-import/README.md && \
46+
$(TERRAFORM_DOCS) markdown ./modules/dynamodb-table-put >./modules/dynamodb-table-put/README.md && \
47+
$(TERRAFORM_DOCS) markdown ./modules/ec2-ami-deletion >./modules/ec2-ami-deletion/README.md && \
48+
$(TERRAFORM_DOCS) markdown ./modules/ec2-instance-cycle >./modules/ec2-instance-cycle/README.md && \
49+
$(TERRAFORM_DOCS) markdown ./modules/iam-user-keyrotation >./modules/iam-user-keyrotation/README.md && \
50+
$(TERRAFORM_DOCS) markdown ./modules/rds-cluster-cycle >./modules/rds-cluster-cycle/README.md && \
51+
$(TERRAFORM_DOCS) markdown ./modules/rds-cluster-snapshot >./modules/rds-cluster-snapshot/README.md && \
52+
$(TERRAFORM_DOCS) markdown ./modules/rds-instance-cycle >./modules/rds-instance-cycle/README.md && \
53+
$(TERRAFORM_DOCS) markdown ./modules/rds-instance-snapshot >./modules/rds-instance-snapshot/README.md
3754

3855
format:
3956
$(TERRAFORM) fmt -list=true ./ && \
40-
$(TERRAFORM) fmt -list=true ./modules/cloudfront-request-rewrite
41-
$(TERRAFORM) fmt -list=true ./modules/dynamodb-table-import
42-
$(TERRAFORM) fmt -list=true ./modules/dynamodb-table-put
43-
$(TERRAFORM) fmt -list=true ./modules/ec2-ami-deletion
44-
$(TERRAFORM) fmt -list=true ./modules/ec2-instance-cycle
45-
$(TERRAFORM) fmt -list=true ./modules/iam-user-keyrotation
46-
$(TERRAFORM) fmt -list=true ./modules/rds-cluster-cycle
47-
$(TERRAFORM) fmt -list=true ./modules/rds-cluster-snapshot
48-
$(TERRAFORM) fmt -list=true ./modules/rds-instance-cycle
57+
$(TERRAFORM) fmt -list=true ./modules/cloudfront-request-rewrite && \
58+
$(TERRAFORM) fmt -list=true ./modules/dynamodb-table-import && \
59+
$(TERRAFORM) fmt -list=true ./modules/dynamodb-table-put && \
60+
$(TERRAFORM) fmt -list=true ./modules/ec2-ami-deletion && \
61+
$(TERRAFORM) fmt -list=true ./modules/ec2-instance-cycle && \
62+
$(TERRAFORM) fmt -list=true ./modules/iam-user-keyrotation && \
63+
$(TERRAFORM) fmt -list=true ./modules/rds-cluster-cycle && \
64+
$(TERRAFORM) fmt -list=true ./modules/rds-cluster-snapshot && \
65+
$(TERRAFORM) fmt -list=true ./modules/rds-instance-cycle && \
4966
$(TERRAFORM) fmt -list=true ./modules/rds-instance-snapshot

‎main.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,11 @@ resource "aws_lambda_function" "function" {
2222
handler = "${var.function_name}.${local.templates[var.template]["lambda_handler"]}"
2323
runtime = var.runtime != null ? var.runtime : local.templates[var.template]["default_runtime"]
2424
source_code_hash = data.archive_file.function.output_base64sha256
25+
26+
tracing_config {
27+
mode = "Active"
28+
}
29+
2530
dynamic "environment" {
2631
for_each = length(var.environment) > 0 ? [1] : []
2732
content {

0 commit comments

Comments
 (0)