feat: Add '--var-file' flag to iac test for loading external TF variable definition files [CFG-1663] #3116
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Adds a
--var-file
flag to iac test for loading external Terraform variable definition files. See commit messages below for details.Where should the reviewer start?
Follow the commits in order:
This commit adds the 'var-file' flag as an available command under 'iac test'. CFG-1663
This commit adds checks around the 'var-file' flag usage: - If the user does not have the 'iacTerraformVarSupport' feature flag, we will throw an error. - If the user provides a non-existent path, we will throw an error. CFG-1663
This commit adds the ability to load an external file by using 'var-file' flag:
How should this be manually tested?
assign yourself the
iacTerraformVarSupport
flag.snyk-dev iac test test/fixtures/iac/terraform/var_deref/nested_var_deref
and check the issues.snyk-dev iac test test/fixtures/iac/terraform/var_deref/nested_var_deref --var-file=test/fixtures/iac/terraform/vars.tf
and check that thesg_open_ssh.tf
has one issue more that is found due to theallow_ssh_external_var_file
var."Bad case" scenarios:
iacTerraformVarSupport
flag and try to run scan (2) from aboveiacTerraformVarSupport
flag and point to a non-existing path or directory and see the relevant errorI also ran checks with other flags, such as detection-depth, sarif, json.
What are the relevant tickets?
CFG-1663
Screenshots
Without the flag:
With the use of the flag (and finding an issue extra for the
test/fixtures/iac/terraform/var_deref/nested_var_deref/sg_open_ssh.tf
, when sharing the variable context of the external definitions file):