Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(trivy): Add terraform_trivy hook and deprecate terraform_tfsec #606

Merged
merged 12 commits into from
Dec 15, 2023

Conversation

ArnauLlamas
Copy link
Contributor

First of all, thank you so much for your amazing work! ❤️
This is the first time I contribute to this repository so if there is any doubt or anything required to be fixed feel free to let me know it!

Put an x into the box if that apply:

  • This PR introduces breaking change.
  • This PR fixes a bug.
  • This PR adds new functionality.
  • This PR enhances existing functionality.

Description of your changes

Adds a new Trivy hook.

Fixes #550

How can we test changes

Create a project with a Terraform file that looks like this:

resource "aws_security_group_rule" "my-rule" {
    type        = "ingress"
    cidr_blocks = ["0.0.0.0/0"]
}

When running the hook it shall show two errors with this configuration and how to fix them.
In order to ignore these errors, add a comment per rule on top of the resource specifying it to ignore it:

#trivy:ignore:AVD-AWS-0107
#trivy:ignore:AVD-AWS-0124
resource "aws_security_group_rule" "my-rule" {
    type        = "ingress"
    cidr_blocks = ["0.0.0.0/0"]
}

This shall make the hook to output no errors and, therefore, pass.

The same can be done with trivy binary executing:

trivy conf $(pwd)/path/to/your/file.tf --exit-code=1

Note: The exit-code flag forces the binary to exit with exit code 1 when any missconfiguration is found.

This has been already tested with pre-commit run and pre-commit run --all commands using this configuration in the .pre-commit-config.yaml file:

repos:
  - repo: https://github.com/arnaullamas/pre-commit-terraform
    rev: 4df7df5c2c9ff3840a4afd458e3dca42f23cd38d
    hooks:
      - id: terraform_trivy
        args:
          - --args=--skip-dirs="**/.terragrunt-cache"

Note: The args key is optional but useful if you currently are on a terragrunt project!

yermulnik
yermulnik previously approved these changes Dec 13, 2023
Copy link
Collaborator

@yermulnik yermulnik left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not familiar with Trivy, though the code looks good to me.
@MaxymVlasov Would be able to provide more thorough and opinionated review though.

@yermulnik yermulnik dismissed their stale review December 13, 2023 14:17

Oops, take my approval back to let Max approve this PR.

Copy link
Collaborator

@MaxymVlasov MaxymVlasov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hook works like a charm. A few tiny fixes and ready to go

Dockerfile Outdated Show resolved Hide resolved
README.md Outdated Show resolved Hide resolved
README.md Outdated Show resolved Hide resolved
README.md Outdated Show resolved Hide resolved
@MaxymVlasov
Copy link
Collaborator

Also, let me add a deprecation notice to tfsec hook and I'll merge it

README.md Outdated Show resolved Hide resolved
README.md Outdated Show resolved Hide resolved
@MaxymVlasov MaxymVlasov changed the title feat(trivy): Add trivy hook feat(trivy): Add terraform_trivy hook and deprecate terraform_tfsec Dec 15, 2023
@MaxymVlasov MaxymVlasov added feature New feature or request hook/terraform_tfsec Bash hook hook/terraform_trivy Bash hook labels Dec 15, 2023
README.md Show resolved Hide resolved
README.md Outdated Show resolved Hide resolved
@MaxymVlasov MaxymVlasov merged commit f3c819a into antonbabenko:master Dec 15, 2023
5 checks passed
antonbabenko pushed a commit that referenced this pull request Dec 15, 2023
# [1.85.0](v1.84.0...v1.85.0) (2023-12-15)

### Features

* **trivy:** Add `terraform_trivy` hook and deprecate `terraform_tfsec` ([#606](#606)) ([f3c819a](f3c819a))
@antonbabenko
Copy link
Owner

This PR is included in version 1.85.0 🎉

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature New feature or request hook/terraform_tfsec Bash hook hook/terraform_trivy Bash hook
Projects
None yet
Development

Successfully merging this pull request may close these issues.

tfsec deprecated, replaced by Trivy. Create a new hook for Trivy
4 participants