antonbabenko

The module covers AWS Backup as one service on one provider: vaults, vault lock, notifications, the logically air-gapped vault, plans and selections at the root, and local submodules for plans, report plans, restore testing and Audit Manager frameworks. All seven examples passed terraform init, terraform validate and terraform plan against an AWS account. What stands between it and terraform-aws-modules is mostly the repository around the module: workflows, scanners, Go and native tests and tool configuration the profile does not carry, a release workflow gated on the current owner, and a cross-region example in a region the profile does not use. In the module code, the family's putin_khuylo gate, a module "disabled" call and examples/basic are missing, and several validations belong in preconditions.

Changes requested before merge.

HIGH findings are open (ladder rule 2).

Findings

HIGH

antonbabenko

The change adds Amazon S3 Files support through a new modules/file-system submodule and the root file_systems input, and the overall shape looks right. What is missing: one access point in the new example has no POSIX user, which the provider documents as required, and two documented behaviours have no code behind them. A file system policy built only from source documents is rejected, and setting security_groups does not stop a security group being created. The file system policy statements also let a caller set resources and not_resources together, which the provider documents as conflicting. examples/file-system passed terraform init and terraform validate, and a terraform plan against a real account planned 54 to add, 0 to change, 0 to destroy; nothing was applied.

Changes requested before merge.

Four HIGH findings are open (ladder rule 2).

Findings

HIGH

antonbabenko

'use strict';

const crypto = require('crypto');

exports.handler = (event, context, callback) => {
    const request = event.Records[0].cf.request;
    const headers = request.headers;
    const method = request.method;
    const body = Buffer.from(request.body.data, 'base64').toString();

antonbabenko

const redirectMap = new Map([
['/issues/weekly-tf-issue-101-best-practices-for-using-terraform-by-google-the-many-ways-to-access-rds-artificial-intelligence-infrastructure-as-code-generator-1473757', 'https://www.weekly.tf/p/weeklytf-issue-101-best-practices-using-terraform-google-many-ways-access-rds-artificial-intelligenc'],
['/issues/weekly-tf-issue-100-using-least-privilege-iam-policies-aws-sam-cli-and-terraform-managing-terraform-state-with-terragrunt-ci-cd-pipeline-in-azure-devops-achieving-balance-with-policy-enforcement-aws-re-invent-1463043', 'https://www.weekly.tf/p/weeklytf-issue-100-using-least-privilege-iam-policies-aws-sam-cli-terraform-managing-terraform-state'],
['/issues/weekly-tf-issue-99-aws-landing-zone-codify-your-infrastructure-with-terraformer-and-terraform-best-practices-gitlab-managed-terraform-state-terrascan-aws-nat-instances-ci-cd-pipelines-for-infrastructure-as-code-with-kief-morris-1448446', 'https://www.weekly.tf/p/weeklytf-issue-99-aws-landing-zone-codify-infrastructure-terrafo

antonbabenko

1. Big success = incredible growth = big investment -> higher risk of losing the pure spirit of open-source + open community. What are the comming actions to reduce this risk and not reproduce the same failing pattern of Docker Inc? / via H.

antonbabenko

#  - repo: local  # @todo: move to pre-commit-terraform, add support for multiple module dirs, and run before terraform_docs
#    hooks:
#      - id: terraform_wrapper
#        name: "Terraform module wrapper - root"
#        entry: /Users/Bob/Sites/terraform-aws-modules/scripts/generate-terraform-wrappers.sh --overwrite
#        language: system
#        pass_filenames: false
#      - id: terraform_wrapper
#        name: "Terraform module wrapper - object"
#        entry: /Users/Bob/Sites/terraform-aws-modules/scripts/generate-terraform-wrappers.sh --module-dir modules/object --overwrite

antonbabenko

#!/bin/bash

# If you are using some terraform-aws-modules, pre-commit-terraform, or other projects I am heavily involved into
# please consider support me on GitHub Sponsors or any other platform!
#
# Here you can see most of my projects - https://github.com/antonbabenko/terraform-aws-devops

find . -type f \( -name "*.tf" -o -name "*.yaml" \) -and \( -not -path "*/.terraform/*" \) -exec \
grep -E 'terraform-aws-modules|antonbabenko/pre-commit-terraform' -q {} + && \
echo "Found some references... You are using some open-source projects by Anton, please support @antonbabenko" && \

antonbabenko

resource "aws_db_instance" "valid_but_ugly" {
  allocated_storage       = 20
  storage_type            = "gp2"
  engine                  = "mysql"
  engine_version          = "5.7"
  instance_class          = "db.t2.micro"

  # flip value to true/false will return multiple violations.
  iam_database_authentication_enabled = local.test2.some[0] == "dd" #tobool("true")
  #(true == true)

antonbabenko

# Copy image from GHCR into private ECR

aws ecr get-login-password --region eu-west-1 | docker login --username AWS --password-stdin 835367859851.dkr.ecr.eu-west-1.amazonaws.com

docker pull ghcr.io/cloudquery/cloudquery:0.13.4
docker tag ghcr.io/cloudquery/cloudquery:0.13.4 835367859851.dkr.ecr.eu-west-1.amazonaws.com/cloudquery:0.13.4
docker push 835367859851.dkr.ecr.eu-west-1.amazonaws.com/cloudquery:0.13.4


# Run Postgres locally

antonbabenko

#!/usr/bin/env bash

set -e

readonly CONTENT_MAIN_TF='module "wrapper" {}'
readonly CONTENT_VARIABLES_TF='variable "items" {
  description = "Maps of items to create a wrapper from. Values are passed through to the module."
  type        = any
  default     = {}
}'