feat: Add tftools

.github/workflows/documentation.yml → .github/workflows/tfdocs.yml

@@ -1,12 +1,12 @@
-name: Generate terraform docs
+name: Terraform Docs
 on:
   - pull_request
 
 jobs:
   docs:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
       with:
         ref: ${{ github.event.pull_request.head.ref }}
 

.github/workflows/tflint.yml

@@ -7,19 +7,20 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
       name: Checkout source code
 
-    - uses: actions/cache@v3
+    - uses: actions/cache@v4
       name: Cache plugin dir
       with:
         path: ~/.tflint.d/plugins
         key: tflint-${{ hashFiles('.tflint.hcl') }}
 
-    - uses: terraform-linters/setup-tflint@v3
+    - uses: terraform-linters/setup-tflint@v4
       name: Setup TFLint
       with:
-        tflint_version: v0.45.0
+        tflint_version: v0.50.3
+        tflint_wrapper: true
 
     - name: Show version
       run: tflint --version
@@ -32,7 +33,11 @@ jobs:
 
     - name: Run TFLint
       run: |
-        tflint -f compact .
-        tflint -f compact modules/cloudfront-app
-        tflint -f compact modules/cloudfront-deployment-policy
-        tflint -f compact modules/cloudfront-s3-origin-bucket-policy
+        tflint -f compact --chdir .
+        tflint -f compact --chdir modules/cloudfront-app
+        tflint -f compact --chdir modules/cloudfront-deployment-policy
+        tflint -f compact --chdir modules/cloudfront-s3-origin-bucket-policy
+
+    - run: echo ${{ steps.tflint.outputs.stdout }}
+    - run: echo ${{ steps.tflint.outputs.stderr }}
+    - run: echo ${{ steps.tflint.outputs.exitcode }}

.github/workflows/tfsec.yml

@@ -0,0 +1,15 @@
+name: Terraform Security Check
+on:
+  pull_request:
+jobs:
+  tfsec:
+    name: tfsec
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Clone repo
+        uses: actions/checkout@master
+      - name: tfsec
+        uses: aquasecurity/[email protected]
+        with:
+          soft_fail: true

.tflint.hcl

@@ -1,11 +1,11 @@
 plugin "terraform" {
     enabled = true
-    version = "0.2.2"
+    version = "0.6.0"
     source  = "github.com/terraform-linters/tflint-ruleset-terraform"
 }
 
 plugin "aws" {
     enabled = true
-    version = "0.21.2"
+    version = "0.30.0"
     source  = "github.com/terraform-linters/tflint-ruleset-aws"
 }

examples/cloudfront-app/versions.tf

@@ -6,6 +6,11 @@ terraform {
       source  = "hashicorp/aws"
       version = "~> 5.0"
     }
+
+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.0"
+    }
   }
 }
 

modules/cloudfront-app/versions.tf

@@ -6,6 +6,11 @@ terraform {
       source  = "hashicorp/aws"
       version = "~> 5.0"
     }
+
+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.0"
+    }
   }
 }
 

modules/cloudfront-deployment-policy/versions.tf

@@ -6,6 +6,11 @@ terraform {
       source  = "hashicorp/aws"
       version = "~> 5.0"
     }
+
+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.0"
+    }
   }
 }
 

modules/cloudfront-s3-origin-bucket-policy/versions.tf

@@ -6,6 +6,11 @@ terraform {
       source  = "hashicorp/aws"
       version = "~> 5.0"
     }
+
+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.0"
+    }
   }
 }