Terraformで予防的ガードレールを実装したい！「Terraform-Compliance」のご紹介

$ terraform -version
Terraform v1.0.1
on darwin_amd64

$ docker -v
Docker version 20.10.6, build 370c289

$ sw_vers
ProductName:	Mac OS X
ProductVersion:	10.15.7
BuildVersion:	19H524

$ terraform-compliance
Unable to find image 'eerkunt/terraform-compliance:latest' locally
latest: Pulling from eerkunt/terraform-compliance
b4d181a07f80: Pull complete
de8ecf497b75: Pull complete
69b92f9e5e70: Pull complete
1f2b8e2c8ad8: Pull complete
ce65eeb74c3c: Pull complete
064992249895: Pull complete
82c71336f0ef: Pull complete
0df1d219a873: Pull complete
Digest: sha256:868b2fdf03434ecbcad8bfdac066e9270f57fe51201ec41dfd6ee7069d787682
Status: Downloaded newer image for eerkunt/terraform-compliance:latest

$ function terraform-compliance { docker run --rm -v $(pwd):/target -i -t eerkunt/terraform-compliance "$@"; }

$ terraform-compliance --version
terraform-compliance v1.3.21 initiated

1.3.21

Feature: Security Groups should be used to protect services/instances
  In order to improve security
  As engineers
  We'll use AWS Security Groups as a Perimeter Defence

Scenario: Ensure all resources have tags
    Given I have resource that supports tags defined
    Then it must contain tags
    And its value must not be null

$ terraform-compliance -p plan.out -f /path/to/feature/files/

$ terraform plan -out=plan.out

resource "aws_s3_bucket" "test-bucket" {
  bucket = "cm-marumo-tf-compliance-test"
  acl    = "private"
}

Feature: S3 related general feature
	Implemented
		- Data must be encrypted at rest (what if it's suppose to be public?, maybe check if it's suppose to be public before? What if it's mistakenly set as public?)
		- Data stored in S3 has versioning enabled


	Questionable checks (only checks if one pass)
	- S3 must have access logging enabled


	Scenario: Data must be encrypted at rest
		Given I have aws_s3_bucket defined
		Then it must have server_side_encryption_configuration

	
	# check if at least one s3 has logging enabled, because logging will require another s3
	@noskip_at_line_20
	Scenario: S3 must have access logging enabled 
		Given I have aws_s3_bucket defined
		When it has logging


	Scenario: Data stored in S3 has versioning enabled
		Given I have aws_s3_bucket defined
		Then it must have versioning
		Then it must have enabled
		And its value must be true

$ terraform plan -out=plan.out

$ terraform-compliance -p plan.out -f tf-compliance/
terraform-compliance v1.3.21 initiated

. Converting terraform plan file.
ERROR: Failed to convert terraform plan file to JSON format via terraform. Here is the error :
None
╷
│ Error: error configuring S3 Backend: no valid credential sources for S3 Backend found.
│
│ Please see https://www.terraform.io/docs/language/settings/backends/s3.html
│ for more information about providing credentials.
│
│ Error: NoCredentialProviders: no valid providers in chain. Deprecated.
│ 	For verbose messaging see aws.Config.CredentialsChainVerboseErrors
│

$ terraform show -json plan.out > plan.out.json

$ terraform-compliance -p plan.out.json -f tf-compliance/
terraform-compliance v1.3.21 initiated

? Features	: /target/tf-compliance/
? Plan File	: /target/plan.out.json

? Running tests. ?

Feature: S3 related general feature  # /target/tf-compliance/S3.feature
    Implemented
    - Data must be encrypted at rest (what if it's suppose to be public?, maybe check if it's suppose to be public before? What if it's mistakenly set as public?)
    - Data stored in S3 has versioning enabled
    Questionable checks (only checks if one pass)
    - S3 must have access logging enabled

    Scenario: Data must be encrypted at rest
        Given I have aws_s3_bucket defined
		Failure: aws_s3_bucket.test-bucket (aws_s3_bucket) does not have server_side_encryption_configuration property.
        Then it must have server_side_encryption_configuration
          Failure:

    @noskip_at_line_20
    Scenario: S3 must have access logging enabled
        Given I have aws_s3_bucket defined
		Failure: Can not find any logging property for aws_s3_bucket resource in terraform plan.
        When it has logging
          Failure:

    Scenario: Data stored in S3 has versioning enabled
        Given I have aws_s3_bucket defined
		Failure: aws_s3_bucket.test-bucket (aws_s3_bucket) does not have versioning property.
        Then it must have versioning
          Failure:
        Then it must have enabled
        And its value must be true

1 features (0 passed, 1 failed)
3 scenarios (0 passed, 3 failed)
8 steps (3 passed, 3 failed, 2 skipped)
Run 1625605475 finished within a moment

resource "aws_s3_bucket" "test-bucket" {
  bucket = "cm-marumo-tf-compliance-test"
  acl    = "private"

  logging {
    target_bucket = "cm-marumo-testlog"
  }

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm     = "aws:kms"
      }
    }
  }

  versioning {
    enabled = true
  }
}

$ terraform plan -out=plan.out
$ terraform show -json plan.out > plan.out.json
$ terraform-compliance -p plan.out.json -f tf-compliance/

terraform-compliance v1.3.21 initiated

? Features	: /target/tf-compliance/
? Plan File	: /target/plan.out.json

? Running tests. ?

Feature: S3 related general feature  # /target/tf-compliance/S3.feature
    Implemented
    - Data must be encrypted at rest (what if it's suppose to be public?, maybe check if it's suppose to be public before? What if it's mistakenly set as public?)
    - Data stored in S3 has versioning enabled
    Questionable checks (only checks if one pass)
    - S3 must have access logging enabled

    Scenario: Data must be encrypted at rest
        Given I have aws_s3_bucket defined
        Then it must have server_side_encryption_configuration

    @noskip_at_line_20
    Scenario: S3 must have access logging enabled
        Given I have aws_s3_bucket defined
        When it has logging

    Scenario: Data stored in S3 has versioning enabled
        Given I have aws_s3_bucket defined
        Then it must have versioning
        Then it must have enabled
        And its value must be true

1 features (1 passed)
3 scenarios (3 passed)
8 steps (8 passed)
Run 1625607902 finished within a moment