Skip to content

Commit

Permalink
Merge pull request #149 from 23andMe/SEC-1517-default-terrascan-config
Browse files Browse the repository at this point in the history 
Adding terrascan config file (#1761)
  • Loading branch information
@sarahc23
sarahc23 authored Aug 9, 2021
2 parents a7a2a4f + 4f776d1 commit 3acea45
Show file tree
Hide file tree
Showing 3 changed files with 23 additions and 4 deletions.
9 changes: 6 additions & 3 deletions README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,8 +35,9 @@ It is a simple combination of various linters, written in `bash`, to help valida
- [Azure](#azure)
- [GitLab](#gitlab)
- [Visual Studio Code](#visual-studio-code)
- [Limitations](#limitations)
- [SSL Certs](#ssl-certs)
- [Community Activity](#community-activity)
- [Limitations](#limitations)
- [How to contribute](#how-to-contribute)
- [License](#license)

Expand Down Expand Up @@ -317,6 +318,8 @@ But if you wish to select or exclude specific linters, we give you full control
| **SNAKEMAKE_SNAKEFMT_CONFIG_FILE** | `.snakefmt.toml` | Filename for [Snakemake configuration](https://github.com/snakemake/snakefmt#configuration) (ex: `pyproject.toml`, `.snakefmt.toml`) |
| **SSL_CERT_SECRET** | `none` | SSL cert to add to the **Super-Linter** trust store. This is needed for users on `self-hosted` runners or need to inject the cert for security standards (ex. ${{ secrets.SSL_CERT }}) |
| **SQL_CONFIG_FILE** | `.sql-config.json` | Filename for [SQL-Lint configuration](https://sql-lint.readthedocs.io/en/latest/files/configuration.html) (ex: `sql-config.json` , `.config.json`) |
| **TERRAFORM_CONFIG_FILE** | `.tflint.hcl` | Filename for [tfLint configuration](https://github.com/terraform-linters/tflint) (ex: `.tflint.hcl`) |
| **TERRAFORM_TERRASCAN_CONFIG_FILE**| `terrascan.toml` | Filename for [terrascan configuration](https://github.com/accurics/terrascan) (ex: `terrascan.toml`) |
| **TYPESCRIPT_ES_CONFIG_FILE** | `.eslintrc.yml` | Filename for [eslint configuration](https://eslint.org/docs/user-guide/configuring#configuration-file-formats) (ex: `.eslintrc.yml`, `.eslintrc.json`) |
| **USE_FIND_ALGORITHM** | `false` | By default, we use `git diff` to find all files in the workspace and what has been updated, this would enable the Linux `find` method instead to find all files to lint |
| **VALIDATE_ALL_CODEBASE** | `true` | Will parse the entire repository and find all files to validate across all types. **NOTE:** When set to `false`, only **new** or **edited** files will be parsed for validation. |
Expand Down Expand Up @@ -402,8 +405,8 @@ As a result, the `VALIDATE_[LANGUAGE]` variables behave differently from those i
| **GITLEAKS_CONFIG_FILE** | `none` | Filename for optional [gitleaks configuration](https://github.com/zricethezav/gitleaks#configuration) (ex: `simple_regex_config.toml`). Uses the [gitleaks default](https://github.com/zricethezav/gitleaks/blob/master/config/default.go) if unspecified |
| **OUTPUT_MODE** | `none` | Additional means for outputting findings, other than writing to stdout. Supported modes: lintly |
| **PYTHON_BANDIT_CONFIG_FILE** | `.bandit` | Filename for [bandit configuration](https://bandit.readthedocs.io/en/latest/config.html) (ex: `.bandit`, `tox.ini`) |
| **RUN_CODE_QUALITY_TOOLS** | `false ` | Flag to enable or disable the entire suite of code-quality-related linters. See below for a list of linters in this pack. |
| **RUN_SECURITY_TOOLS** | `true ` | Flag to enable or disable the entire suite of security tools. See below for a list of tools in this pack. |
| **RUN_CODE_QUALITY_TOOLS** | `false` | Flag to enable or disable the entire suite of code-quality-related linters. See below for a list of linters in this pack. |
| **RUN_SECURITY_TOOLS** | `true` | Flag to enable or disable the entire suite of security tools. See below for a list of tools in this pack. |
| **VALIDATE_CLOUDFORMATION_CFN_NAG** | `true` | Flag to enable or disable the security linting process of the AWS CloudFormation language. |
| **VALIDATE_GITLEAKS** | `true` | Flag to enable or disable the linting process of potentially leaked secrets across all files and languages. |
| **VALIDATE_PYTHON_BANDIT** | `true` | Flag to enable or disable the linting process of the Python language. (Utilizing: bandit) |
Expand Down
14 changes: 14 additions & 0 deletions TEMPLATES/terrascan.toml
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
# terrascan configuration file https://github.com/accurics/terrascan/blob/master/config/terrascan.toml

# scan and skip rules configuration
[rules]
# scan rules (list of rules to scan, adding rules here will override rules in the policy path)
# scan-rules = [
# "AWS.S3Bucket.DS.High.1043",
# "AWS.S3Bucket.IAM.High.0370"
# ]

# skip rules (list of rules to skip)
skip-rules = [
"AC_AWS_0320"
]
4 changes: 3 additions & 1 deletion lib/linter.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -175,6 +175,8 @@ SQL_FILE_NAME="${SQL_CONFIG_FILE:-.sql-config.json}"
# shellcheck disable=SC2034 # Variable is referenced indirectly
TERRAFORM_FILE_NAME=".tflint.hcl"
# shellcheck disable=SC2034 # Variable is referenced indirectly
TERRAFORM_TERRASCAN_FILE_NAME="${TERRAFORM_TERRASCAN_CONFIG_FILE:-terrascan.toml}"
# shellcheck disable=SC2034 # Variable is referenced indirectly
TSX_FILE_NAME="${TYPESCRIPT_ES_CONFIG_FILE:-.eslintrc.yml}"
# shellcheck disable=SC2034 # Variable is referenced indirectly
TYPESCRIPT_ES_FILE_NAME="${TYPESCRIPT_ES_CONFIG_FILE:-.eslintrc.yml}"
Expand Down Expand Up @@ -921,7 +923,7 @@ LINTER_COMMANDS_ARRAY['STATES']="asl-validator --json-path"
LINTER_COMMANDS_ARRAY['SQL']="sql-lint --config ${SQL_LINTER_RULES}"
LINTER_COMMANDS_ARRAY['TEKTON']="tekton-lint"
LINTER_COMMANDS_ARRAY['TERRAFORM']="tflint -c ${TERRAFORM_LINTER_RULES}"
LINTER_COMMANDS_ARRAY['TERRAFORM_TERRASCAN']="terrascan scan -i terraform -t all ${LINTER_OPTS[TERRAFORM_TERRASCAN]} -f "
LINTER_COMMANDS_ARRAY['TERRAFORM_TERRASCAN']="terrascan scan -i terraform -t all -c ${TERRAFORM_TERRASCAN_LINTER_RULES} ${LINTER_OPTS[TERRAFORM_TERRASCAN]} -f"
LINTER_COMMANDS_ARRAY['TERRAGRUNT']="terragrunt hclfmt --terragrunt-check --terragrunt-log-level error --terragrunt-hclfmt-file"
LINTER_COMMANDS_ARRAY['TSX']="eslint --no-eslintrc -c ${TSX_LINTER_RULES}"
LINTER_COMMANDS_ARRAY['TYPESCRIPT_ES']="eslint --no-eslintrc -c ${TYPESCRIPT_ES_LINTER_RULES}"
Expand Down

0 comments on commit 3acea45

Please sign in to comment.