Skip to content
GitLab
Explore
Sign in
Register
shore
Am I live
Compare revisions
a77f9339c513d21f8ddf08c092e8436358f3ff44 to ce81f558ed25500290ad88368bc39db9feb1c02c
Commits on Source (2)
Add Checkov pre-commit hook.
· 5dbeb94b
nimrod
authored
Jan 09, 2022
5dbeb94b
Address Checkov warnings.
· ce81f558
nimrod
authored
Jan 09, 2022
Mostly ignore things I'm not interested in but it did find somethings.
ce81f558
Hide whitespace changes
Inline
Side-by-side
.pre-commit-config.yaml
View file @
ce81f558
...
...
@@ -62,6 +62,11 @@ repos:
-
id
:
terraform-fmt
-
id
:
terraform-validate
-
repo
:
https://github.com/bridgecrewio/checkov.git
rev
:
2.0.708
hooks
:
-
id
:
checkov
-
repo
:
https://github.com/ambv/black.git
rev
:
21.10b0
hooks
:
...
...
functions.tf
View file @
ce81f558
...
...
@@ -108,20 +108,25 @@ output "timeout" {
}
resource
"aws_lambda_function"
"function"
{
count
=
length
(
local
.
functions
)
runtime
=
var
.
runtime
function_name
=
local
.
function_names
[
count
.
index
]
role
=
local
.
lambda_role_arn
source_code_hash
=
filebase64sha256
(
"payload.zip"
)
s3_bucket
=
local
.
payloads_bucket_name
s3_key
=
local
.
payload_object_name
s3_object_version
=
local
.
payload_object_version
package_type
=
"Zip"
handler
=
"
${
local
.
functions
[
count
.
index
]
}
.handler"
description
=
"
${
local
.
module}
${
local
.
functions
[
count
.
index
]
}
check in
${
local
.
env
}
."
memory_size
=
var
.
memory_size
tags
=
local
.
common_tags
timeout
=
var
.
timeout
# checkov:skip=CKV_AWS_50
# checkov:skip=CKV_AWS_116
# checkov:skip=CKV_AWS_117
# checkov:skip=CKV_AWS_173
count
=
length
(
local
.
functions
)
runtime
=
var
.
runtime
function_name
=
local
.
function_names
[
count
.
index
]
role
=
local
.
lambda_role_arn
source_code_hash
=
filebase64sha256
(
"payload.zip"
)
s3_bucket
=
local
.
payloads_bucket_name
s3_key
=
local
.
payload_object_name
s3_object_version
=
local
.
payload_object_version
package_type
=
"Zip"
handler
=
"
${
local
.
functions
[
count
.
index
]
}
.handler"
description
=
"
${
local
.
module}
${
local
.
functions
[
count
.
index
]
}
check in
${
local
.
env
}
."
memory_size
=
var
.
memory_size
reserved_concurrent_executions
=
-1
tags
=
local
.
common_tags
timeout
=
var
.
timeout
environment
{
variables
=
{
...
...
log-groups.tf
View file @
ce81f558
resource
"aws_cloudwatch_log_group"
"lambda"
{
# checkov:skip=CKV_AWS_158
count
=
length
(
local
.
function_names
)
name
=
"/aws/lambda/
${
local
.
function_names
[
count
.
index
]
}
"
retention_in_days
=
var
.
log_retention
...
...
s3.tf
View file @
ce81f558
resource
"aws_s3_bucket"
"payloads"
{
# checkov:skip=CKV_AWS_18
# checkov:skip=CKV_AWS_19
# checkov:skip=CKV_AWS_144
# checkov:skip=CKV_AWS_145
bucket
=
local
.
Name
tags
=
local
.
common_tags
acl
=
"private"
...
...
@@ -9,11 +13,21 @@ resource "aws_s3_bucket" "payloads" {
}
}
locals
{
payloads_bucket_arn
=
aws_s3_bucket
.
payloads
.
arn
payloads_bucket_name
=
aws_s3_bucket
.
payloads
.
bucket
}
resource
"aws_s3_bucket_public_access_block"
"payloads"
{
bucket
=
aws_s3_bucket
.
payloads
.
bucket
block_public_acls
=
true
block_public_policy
=
true
ignore_public_acls
=
true
restrict_public_buckets
=
true
}
output
"payloads_bucket_arn"
{
description
=
"ARN of the payloads S3 bucket."
value
=
local
.
payloads_bucket_arn
...
...
@@ -25,6 +39,7 @@ output "payloads_bucket_name" {
}
resource
"aws_s3_bucket_object"
"payload"
{
# checkov:skip=CKV_AWS_186
bucket
=
local
.
payloads_bucket_name
key
=
"payload.zip"
source
=
"payload.zip"
...
...
sms-notify.tf
View file @
ce81f558
...
...
@@ -12,19 +12,24 @@ variable "twilio_from_number" {
}
resource
"aws_lambda_function"
"sms_notify"
{
runtime
=
var
.
runtime
function_name
=
"
${
local
.
function_name_prefix
}
-sms-notify"
role
=
local
.
lambda_role_arn
source_code_hash
=
filebase64sha256
(
"payload.zip"
)
s3_bucket
=
local
.
payloads_bucket_name
s3_key
=
local
.
payload_object_name
s3_object_version
=
local
.
payload_object_version
package_type
=
"Zip"
handler
=
"sms_notify.handler"
description
=
"Send SMS message notification using Twilio."
memory_size
=
var
.
memory_size
tags
=
local
.
common_tags
timeout
=
var
.
timeout
# checkov:skip=CKV_AWS_50
# checkov:skip=CKV_AWS_116
# checkov:skip=CKV_AWS_117
# checkov:skip=CKV_AWS_173
runtime
=
var
.
runtime
function_name
=
"
${
local
.
function_name_prefix
}
-sms-notify"
role
=
local
.
lambda_role_arn
source_code_hash
=
filebase64sha256
(
"payload.zip"
)
s3_bucket
=
local
.
payloads_bucket_name
s3_key
=
local
.
payload_object_name
s3_object_version
=
local
.
payload_object_version
package_type
=
"Zip"
handler
=
"sms_notify.handler"
description
=
"Send SMS message notification using Twilio."
memory_size
=
var
.
memory_size
reserved_concurrent_executions
=
-1
tags
=
local
.
common_tags
timeout
=
var
.
timeout
environment
{
variables
=
{
...
...
@@ -103,6 +108,7 @@ resource "aws_sns_topic_subscription" "sms_notify" {
]
}
resource
"aws_cloudwatch_log_group"
"sms_notify"
{
# checkov:skip=CKV_AWS_158
name
=
"/aws/lambda/
${
local
.
function_name_prefix
}
-sms-notify"
retention_in_days
=
var
.
log_retention
tags
=
local
.
common_tags
...
...
sns.tf
View file @
ce81f558
resource
"aws_sns_topic"
"topic"
{
# checkov:skip=CKV_AWS_26
name
=
local
.
Name
tags
=
local
.
common_tags
}
...
...