From cf8622aa2bf26246ceac8c8c6fde04ed9cf8a673 Mon Sep 17 00:00:00 2001 From: cybershady Date: Sat, 10 Aug 2024 23:02:56 -0600 Subject: [PATCH] fixed file structure #2 --- .github/checkov.yml | 48 +++++++++++++++++++++++++++++++++++++++++++++ .gitignore | 1 - backend.tf | 7 +++++++ main.tf | 0 outputs.tf | 0 provider.tf | 27 +++++++++++++++++++++++++ terraform.tfvars | 2 ++ variables.tf | 0 8 files changed, 84 insertions(+), 1 deletion(-) create mode 100644 .github/checkov.yml create mode 100644 backend.tf create mode 100644 main.tf create mode 100644 outputs.tf create mode 100644 provider.tf create mode 100644 terraform.tfvars create mode 100644 variables.tf diff --git a/.github/checkov.yml b/.github/checkov.yml new file mode 100644 index 0000000..2027ddd --- /dev/null +++ b/.github/checkov.yml @@ -0,0 +1,48 @@ +name: checkov + +# Controls when the workflow will run +on: + # Triggers the workflow on push or pull request events but only for the "main" branch + push: + branches: [ "main", "master" ] + pull_request: + branches: [ "main", "master" ] + + # Allows you to run this workflow manually from the Actions tab + workflow_dispatch: + +# A workflow run is made up of one or more jobs that can run sequentially or in parallel +jobs: + # This workflow contains a single job called "scan" + scan: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status + + # The type of runner that the job will run on + runs-on: ubuntu-latest + + # Steps represent a sequence of tasks that will be executed as part of the job + steps: + # Checks-out your repository under $GITHUB_WORKSPACE, so follow-up steps can access it + - uses: actions/checkout@v3 + + - name: Checkov GitHub Action + uses: bridgecrewio/checkov-action@v12 + with: + # This will add both a CLI output to the console and create a results.sarif file + output_format: cli,sarif + output_file_path: console,results.sarif + + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v2 + + # Results are generated only on a success or failure + # this is required since GitHub by default won't run the next step + # when the previous one has failed. Security checks that do not pass will 'fail'. + # An alternative is to add `continue-on-error: true` to the previous step + # Or 'soft_fail: true' to checkov. + if: success() || failure() + with: + sarif_file: results.sarif \ No newline at end of file diff --git a/.gitignore b/.gitignore index 2faf43d..fb22f57 100644 --- a/.gitignore +++ b/.gitignore @@ -13,7 +13,6 @@ crash.*.log # password, private keys, and other secrets. These should not be part of version # control as they are data points which are potentially sensitive and subject # to change depending on the environment. -*.tfvars *.tfvars.json # Ignore override files as they are usually used to override resources locally and so diff --git a/backend.tf b/backend.tf new file mode 100644 index 0000000..dfd1c46 --- /dev/null +++ b/backend.tf @@ -0,0 +1,7 @@ +terraform { + backend "remote" { + hostname = "app.terraform.io" + organization = "cloudcodecoffee" + workspaces { name = "playground" } + } +} \ No newline at end of file diff --git a/main.tf b/main.tf new file mode 100644 index 0000000..e69de29 diff --git a/outputs.tf b/outputs.tf new file mode 100644 index 0000000..e69de29 diff --git a/provider.tf b/provider.tf new file mode 100644 index 0000000..c8305b0 --- /dev/null +++ b/provider.tf @@ -0,0 +1,27 @@ +terraform { + required_version = ">= 1.0.0, < 2.0.0" + + required_providers { + aws = { + source = "hashicorp/aws" + version = "~> 5.0" + } + } +} + +provider "aws" { + region = var.region + allowed_account_ids = [var.aws_account] + + assume_role { + role_arn = "arn:aws:iam::${var.aws_account}:role/svc_terraform" + session_name = "Terraform" + } + + default_tags { + tags = { + ManagedBy = "terraform" + Workspace = terraform.workspace + } + } +} \ No newline at end of file diff --git a/terraform.tfvars b/terraform.tfvars new file mode 100644 index 0000000..c44606e --- /dev/null +++ b/terraform.tfvars @@ -0,0 +1,2 @@ +name = "playground" +region = "us-west-2" \ No newline at end of file diff --git a/variables.tf b/variables.tf new file mode 100644 index 0000000..e69de29