diff --git a/.github/workflows/terraform-fmt.yaml b/.github/workflows/terraform-fmt.yaml new file mode 100644 index 0000000..0284855 --- /dev/null +++ b/.github/workflows/terraform-fmt.yaml @@ -0,0 +1,24 @@ +name: terraform-fmt +on: + pull_request: + +permissions: + id-token: write + contents: read + +jobs: + terraform-fmt: + runs-on: ubuntu-latest + + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Setup Terraform + uses: hashicorp/setup-terraform@v3 + with: + terraform_version: "1.5.5" + + - name: Terraform Format + run: terraform fmt -check -recursive -diff + \ No newline at end of file diff --git a/.github/workflows/tflint.yaml b/.github/workflows/tflint.yaml new file mode 100644 index 0000000..6bdc23b --- /dev/null +++ b/.github/workflows/tflint.yaml @@ -0,0 +1,26 @@ +name: tflint +on: + pull_request: + +permissions: + id-token: write + contents: read + +jobs: + tflint: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v4 + name: Checkout source code + + - uses: terraform-linters/setup-tflint@v4 + name: Setup TFLint + with: + tflint_version: v0.44.1 + + - name: tflint init + run: tflint --init + + - name: Run TFLint + run: tflint --recursive --config "$(pwd)/.tflint.hcl" \ No newline at end of file diff --git a/.github/workflows/tfsec.yml b/.github/workflows/tfsec.yml new file mode 100644 index 0000000..ed5e791 --- /dev/null +++ b/.github/workflows/tfsec.yml @@ -0,0 +1,40 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: tfsec + +on: + push: + branches: [ "main" ] + pull_request: + branches: [ "main" ] + schedule: + - cron: '32 14 * * 6' + +permissions: + actions: read + contents: read + security-events: write + +jobs: + tfsec: + name: Run tfsec sarif report + runs-on: ubuntu-latest + + + steps: + - name: Clone repo + uses: actions/checkout@v4 + + - name: Run tfsec + uses: aquasecurity/tfsec-sarif-action@21ded20e8ca120cd9d3d6ab04ef746477542a608 + with: + sarif_file: tfsec.sarif + + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v2 + with: + # Path to SARIF file relative to the root of the repository + sarif_file: tfsec.sarif diff --git a/.tflint.hcl b/.tflint.hcl new file mode 100644 index 0000000..f942322 --- /dev/null +++ b/.tflint.hcl @@ -0,0 +1,5 @@ +plugin "aws" { + enabled = true + version = "0.33.0" + source = "github.com/terraform-linters/tflint-ruleset-aws" +} \ No newline at end of file diff --git a/backend.tf b/backend.tf index 1e1e50c..12c0dbe 100644 --- a/backend.tf +++ b/backend.tf @@ -1,3 +1,3 @@ terraform { - backend "s3" {} + backend "s3" {} }