feat(terraform): Terraform Plan snapshot scanning support #6176
Conversation
nikpivkin
requested review from
simar7,
knqyf263 and
DmitriyLewen
as code owners
nikpivkin
force-pushed
the
tf-plan-snapshot
branch
from
686d227 to
46bf2fc
Compare
| expectedFiles []string | ||
| }{ | ||
| { | ||
| name: "just resource", |
There was a problem hiding this comment.
how about reusing dir and name vars to reduce test code, since they are called the same anyway.
simar7
force-pushed
the
tf-plan-snapshot
branch
from
9f6b70f to
7d66261
Compare
| }, | ||
| { | ||
| dir: "with-remote-module", | ||
| expectedDir: path.Join("terraform-aws-modules", "s3-bucket", "aws", "main.tf"), |
There was a problem hiding this comment.
Checking the path of a remote module is not reliable, as the result may depend on the order in which the tests are executed. If the module is not in the cache, the path is a reference to the git, otherwise the path to the module is in the cache.
There was a problem hiding this comment.
I wasn't able to make this test fail, is it flaky? Is there any way to test without the effects of the cache?
There was a problem hiding this comment.
- clear the cache
rm -rf $TMPDIR/.aqua. - comment out the first two test cases so that the test with the remote module is the first.
- run test:
Error: Not equal:
expected: "terraform-aws-modules/s3-bucket/aws/main.tf"
actual : "git::https:/github.com/terraform-aws-modules/terraform-aws-s3-bucket?ref=3a1c80b29fdf8fc682d2749456ec36ecbaf4ce14/main.tf"There was a problem hiding this comment.
Since only the remote module is used in this test case, we only need to verify that the check detected misconfig. I'll update the test
There was a problem hiding this comment.
I created an issue in defsec asking to add the ability to skip cache to avoid fluky tests, but the issues are now closed. Can we move this issue to Trivy?
There was a problem hiding this comment.
I created an issue in defsec asking to add the ability to skip cache to avoid fluky tests, but the issues are now closed. Can we move this issue to Trivy?
Yes please, if it's a small change you can just make a PR without the need to track with an issue.
Trivy has added support for scanning terraform plan snapshots and thus so updated the config names. See (PR)[aquasecurity/trivy#6176)
Trivy has added support for scanning terraform plan snapshots and thus so updated the config names. See [PR](aquasecurity/trivy#6176)
Trivy has added support for scanning terraform plan snapshots and thus so updated the config names. See [PR](aquasecurity/trivy#6176)
Description
Added a new Terraform Plan file scanner
Related issues
Checklist