Merge pull request #2 from zachrundle/gh_actions2

Gh actions2

.github/workflows/tf-fmt-check.yml

@@ -0,0 +1,21 @@
+name: tfactions
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+jobs:
+  tfactions:
+    name: tfactions
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - uses: hashicorp/setup-terraform@v3
+        with:
+          cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}
+
+      - name: Terraform fmt
+        id: fmt
+        run: terraform fmt -check

.github/workflows/tfsec.yml

@@ -1,18 +1,37 @@
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
 name: tfsec
+
 on:
   push:
-    branches:
-      - main
+    branches: [ "main" ]
   pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '27 20 * * 5'
+
 jobs:
   tfsec:
-    name: tfsec
+    name: Run tfsec sarif report
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
 
     steps:
       - name: Clone repo
-        uses: actions/checkout@master
-      - name: tfsec
-        uses: aquasecurity/[email protected]
+        uses: actions/checkout@v4
+
+      - name: Run tfsec
+        uses: aquasecurity/tfsec-sarif-action@21ded20e8ca120cd9d3d6ab04ef746477542a608
+        with:
+          sarif_file: tfsec.sarif
+
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@v3
         with:
-          soft_fail: true
+          # Path to SARIF file relative to the root of the repository
+          sarif_file: tfsec.sarif

provider.tf

@@ -14,7 +14,7 @@ provider "aws" {
   allowed_account_ids = [var.aws_account]
 
   assume_role {
-    role_arn     = "arn:aws:iam::${var.aws_account}:role/svc_terraform"
+    role_arn     = "arn:aws:iam::${var.aws_account}:role/terraform-service"
     session_name = "Terraform"
   }
 

variables.tf

@@ -0,0 +1,13 @@
+variable "name" {
+  type = string
+}
+
+variable "region" {
+  description = "AWS region to create resources in"
+  type        = string
+  default     = "us-east-1"
+}
+
+variable "aws_account" {
+  description = "Account number to create AWS resources in. This variable should be defined in the Terraform Cloud workspace settings"
+}