rule

Documentation

Index

• func CheckRule(r *Rule, resourceBlock block.Block, module block.Module, ignoreErrors bool) (resultSet result.Set)
• func IsRuleRequiredForBlock(rule *Rule, b block.Block) bool
• type Rule
  • func (r Rule) ID() string
  • func (r Rule) MatchesID(id string) bool
• type RuleDocumentation

Functions

func CheckRule

func CheckRule(r *Rule, resourceBlock block.Block, module block.Module, ignoreErrors bool) (resultSet result.Set)

CheckRule the provided HCL block against the rule

func IsRuleRequiredForBlock

func IsRuleRequiredForBlock(rule *Rule, b block.Block) bool

IsRuleRequiredForBlock returns true if the Rule should be applied to the given HCL block

Types

type Rule

type Rule struct {
	LegacyID string

	Service   string // EC2
	ShortCode string // ebs-volume-encrypted

	Documentation   RuleDocumentation
	Provider        provider.Provider
	RequiredTypes   []string
	RequiredLabels  []string
	RequiredSources []string
	DefaultSeverity severity.Severity
	CheckFunc       func(result.Set, block.Block, block.Module)
}

Rule is a targeted security test which can be applied to terraform templates. It includes the types to run on e.g. "resource", and the labels to run on e.g. "aws_s3_bucket".

func (Rule) ID

func (r Rule) ID() string

func (Rule) MatchesID

func (r Rule) MatchesID(id string) bool

type RuleDocumentation

type RuleDocumentation struct {

	// Summary is a brief description of the check, e.g. "Unencrypted S3 Bucket"
	Summary string

	// Explanation (markdown) contains reasoning for the check, details on it's value, and remediation info
	Explanation string

	// Impact contains a brief summary of the impact of failing the check
	Impact string

	// Resolution contains a brief summary of the resolution for the failing check
	Resolution string

	// BadExample (hcl) contains Terraform code which would cause the check to fail
	BadExample []string

	// GoodExample (hcl) modifies the BadExample content to cause the check to pass
	GoodExample []string

	// Links are URLs which contain further reading related to the check
	Links []string
}