Skip to content

Commit ed82dd0

Browse files
aidenvaines-cgiaidenvaines-cgi
committed
CCM-6633 repo tidy
1 parent 2110f9d commit ed82dd0

4 files changed

Lines changed: 258 additions & 0 deletions

File tree

‎scripts/terraform/terraform.lib.sh‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/bin/bash
2+
3+
# WARNING: Please DO NOT edit this file! It is maintained in the Repository Template (https://github.com/nhs-england-tools/repository-template). Raise a PR instead.
4+
5+
set -euo pipefail
6+
7+
# A set of Terraform functions written in Bash.
8+
#
9+
# Usage:
10+
# $ source ./terraform.lib.sh
11+
12+
# ==============================================================================
13+
# Common Terraform functions.
14+
15+
# Format Terraform code.
16+
# Arguments (provided as environment variables):
17+
# dir=[path to a directory where the command will be executed, relative to the project's top-level directory, default is '.']
18+
# opts=[options to pass to the Terraform fmt command, default is '-recursive']
19+
function terraform-fmt() {
20+
for d in "${PWD}infrastructure/"*; do
21+
if [ -d "$d" ]; then
22+
terraform fmt --recursive "${d}"
23+
fi
24+
done
25+
}

‎scripts/terraform/terraform.mk‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# This file is for you! Edit it to implement your own Terraform make targets.
2+
3+
# ==============================================================================
4+
# Custom implementation - implementation of a make target should not exceed 5 lines of effective code.
5+
# In most cases there should be no need to modify the existing make targets.
6+
7+
terraform-fmt: # Format Terraform files - optional: terraform_dir|dir=[path to a directory where the command will be executed, relative to the project's top-level directory, default is one of the module variables or the example directory, if not set], terraform_opts|opts=[options to pass to the Terraform fmt command, default is '-recursive'] @Quality
8+
make _terraform cmd="fmt" \
9+
dir=$(or ${terraform_dir}, ${dir}) \
10+
opts=$(or ${terraform_opts}, ${opts})
11+
12+
_terraform: # Terraform command wrapper - mandatory: cmd=[command to execute]; optional: dir=[path to a directory where the command will be executed, relative to the project's top-level directory, default is one of the module variables or the example directory, if not set], opts=[options to pass to the Terraform command, default is none/empty]
13+
# 'TERRAFORM_STACK' is passed to the functions as environment variable
14+
TERRAFORM_STACK=$(or ${TERRAFORM_STACK}, $(or ${terraform_stack}, $(or ${STACK}, ${stack})))
15+
dir=$(or ${dir}, ${TERRAFORM_STACK})
16+
. "scripts/terraform/terraform.lib.sh"; \
17+
terraform-${cmd} # 'dir' and 'opts' are accessible by the function as environment variables, if set
18+
19+
# ==============================================================================
20+
# Quality checks - please DO NOT edit this section!
21+
22+
terraform-shellscript-lint: # Lint all Terraform module shell scripts @Quality
23+
for file in $$(find scripts/terraform -type f -name "*.sh"); do
24+
file=$${file} scripts/shellscript-linter.sh
25+
done
26+
27+
terraform-sec: # TFSEC check against Terraform files - optional: terraform_dir|dir=[path to a directory where the command will be executed, relative to the project's top-level directory, default is one of the module variables or the example directory, if not set], terraform_opts|opts=[options to pass to the Terraform fmt command, default is '-recursive'] @Quality
28+
tfsec infrastructure/terraform \
29+
--force-all-dirs \
30+
--exclude-downloaded-modules \
31+
--config-file scripts/config/tfsec.yml
32+
33+
# ==============================================================================
34+
# Configuration - please DO NOT edit this section!
35+
36+
terraform-install: # Install Terraform @Installation
37+
make _install-dependency name="terraform"
38+
39+
# ==============================================================================
40+
41+
${VERBOSE}.SILENT: \
42+
_terraform \
43+
clean \
44+
terraform-apply \
45+
terraform-destroy \
46+
terraform-example-clean \
47+
terraform-example-destroy-aws-infrastructure \
48+
terraform-example-provision-aws-infrastructure \
49+
terraform-fmt \
50+
terraform-init \
51+
terraform-install \
52+
terraform-plan \
53+
terraform-shellscript-lint \
54+
terraform-validate \

‎scripts/terraform/terraform.sh‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
#!/bin/bash
2+
3+
# WARNING: Please DO NOT edit this file! It is maintained in the Repository Template (https://github.com/nhs-england-tools/repository-template). Raise a PR instead.
4+
5+
set -euo pipefail
6+
7+
# Terraform command wrapper. It will run the command natively if Terraform is
8+
# installed, otherwise it will run it in a Docker container.
9+
#
10+
# Usage:
11+
# $ [options] ./terraform.sh
12+
#
13+
# Options:
14+
# cmd=command # Terraform command to execute
15+
# FORCE_USE_DOCKER=true # If set to true the command is run in a Docker container, default is 'false'
16+
# VERBOSE=true # Show all the executed commands, default is 'false'
17+
18+
# ==============================================================================
19+
20+
function main() {
21+
22+
cd "$(git rev-parse --show-toplevel)"
23+
24+
if command -v terraform > /dev/null 2>&1 && ! is-arg-true "${FORCE_USE_DOCKER:-false}"; then
25+
# shellcheck disable=SC2154
26+
cmd=$cmd run-terraform-natively
27+
else
28+
cmd=$cmd run-terraform-in-docker
29+
fi
30+
}
31+
32+
# Run Terraform natively.
33+
# Arguments (provided as environment variables):
34+
# cmd=[Terraform command to execute]
35+
function run-terraform-natively() {
36+
37+
# shellcheck disable=SC2086
38+
terraform $cmd
39+
}
40+
41+
# Run Terraform in a Docker container.
42+
# Arguments (provided as environment variables):
43+
# cmd=[Terraform command to execute]
44+
function run-terraform-in-docker() {
45+
46+
# shellcheck disable=SC1091
47+
source ./scripts/docker/docker.lib.sh
48+
49+
# shellcheck disable=SC2155
50+
local image=$(name=hashicorp/terraform docker-get-image-version-and-pull)
51+
# shellcheck disable=SC2086
52+
docker run --rm --platform linux/amd64 \
53+
--volume "$PWD":/workdir \
54+
--workdir /workdir \
55+
"$image" \
56+
$cmd
57+
}
58+
59+
# ==============================================================================
60+
61+
function is-arg-true() {
62+
63+
if [[ "$1" =~ ^(true|yes|y|on|1|TRUE|YES|Y|ON)$ ]]; then
64+
return 0
65+
else
66+
return 1
67+
fi
68+
}
69+
70+
# ==============================================================================
71+
72+
is-arg-true "${VERBOSE:-false}" && set -x
73+
74+
main "$@"
75+
76+
exit 0

‎scripts/terraform/tfsec.sh‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
#!/usr/bin/env bash
2+
3+
# WARNING: Please DO NOT edit this file! It is maintained in the Repository Template (https://github.com/NHSDigital/nhs-notify-repository-template). Raise a PR instead.
4+
5+
set -euo pipefail
6+
7+
# TFSec command wrapper. It will run the command natively if TFSec is
8+
# installed, otherwise it will run it in a Docker container.
9+
# Run tfsec for security checks on Terraform code.
10+
#
11+
# Usage:
12+
# $ ./tfsec.sh [directory]
13+
# ==============================================================================
14+
15+
function main() {
16+
17+
cd "$(git rev-parse --show-toplevel)"
18+
19+
local dir_to_scan=${1:-.}
20+
21+
if command -v tfsec > /dev/null 2>&1 && ! is-arg-true "${FORCE_USE_DOCKER:-false}"; then
22+
# shellcheck disable=SC2154
23+
run-tfsec-natively "$dir_to_scan"
24+
else
25+
run-tfsec-in-docker "$dir_to_scan"
26+
fi
27+
}
28+
29+
# Run tfsec on the specified directory.
30+
# Arguments:
31+
# $1 - Directory to scan
32+
function run-tfsec-natively() {
33+
34+
local dir_to_scan="$1"
35+
36+
echo "TFSec found locally, running natively"
37+
38+
echo "Running TFSec on directory: $dir_to_scan"
39+
tfsec \
40+
--concise-output \
41+
--force-all-dirs \
42+
--exclude-downloaded-modules \
43+
--config-file scripts/config/tfsec.yaml \
44+
--format text \
45+
--soft-fail \
46+
"$dir_to_scan"
47+
48+
check-tfsec-status
49+
}
50+
51+
# Check the exit status of tfsec.
52+
function check-tfsec-status() {
53+
54+
if [ $? -eq 0 ]; then
55+
echo "TFSec completed successfully."
56+
else
57+
echo "TFSec found issues."
58+
exit 1
59+
fi
60+
}
61+
62+
function run-tfsec-in-docker() {
63+
64+
# shellcheck disable=SC1091
65+
source ./scripts/docker/docker.lib.sh
66+
local dir_to_scan="$1"
67+
68+
# shellcheck disable=SC2155
69+
local image=$(name=aquasec/tfsec docker-get-image-version-and-pull)
70+
# shellcheck disable=SC2086
71+
echo "TFSec not found locally, running in Docker Container"
72+
echo "Running TFSec on directory: $dir_to_scan"
73+
docker run --rm --platform linux/amd64 \
74+
--volume "$PWD":/workdir \
75+
--workdir /workdir \
76+
"$image" \
77+
--concise-output \
78+
--force-all-dirs \
79+
--exclude-downloaded-modules \
80+
--config-file scripts/config/tfsec.yaml \
81+
--format text \
82+
--soft-fail \
83+
"$dir_to_scan"
84+
check-tfsec-status
85+
}
86+
# ==============================================================================
87+
88+
function is-arg-true() {
89+
90+
if [[ "$1" =~ ^(true|yes|y|on|1|TRUE|YES|Y|ON)$ ]]; then
91+
return 0
92+
else
93+
return 1
94+
fi
95+
}
96+
97+
# ==============================================================================
98+
99+
is-arg-true "${VERBOSE:-false}" && set -x
100+
101+
main "$@"
102+
103+
exit 0

0 commit comments

Comments
 (0)