diff --git a/Dockerfile b/Dockerfile index 5d3f8906b..239994448 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,36 +1,166 @@ -FROM ubuntu:18.04 - -ARG PRE_COMMIT_VERSION="2.11.1" -ARG TERRAFORM_VERSION="0.15.0" -ARG TFSEC_VERSION="v0.39.21" -ARG TERRAFORM_DOCS_VERSION="v0.12.0" -ARG TFLINT_VERSION="v0.27.0" -ARG CHECKOV_VERSION="1.0.838" +FROM ubuntu:20.04 as builder # Install general dependencies RUN apt update && \ - apt install -y curl git gawk unzip software-properties-common + DEBIAN_FRONTEND=noninteractive apt install -y \ + # Needed for pre-commit in next build stage + git \ + libpcre2-8-0 \ + # Builder deps + unzip \ + software-properties-common \ + curl \ + python3 \ + python3-pip && \ + # Upgrade pip for be able get latest Checkov + python3 -m pip install --upgrade pip && \ + # Cleanup + rm -rf /var/lib/apt/lists/* -# Install tools -RUN add-apt-repository ppa:deadsnakes/ppa && \ - apt install -y python3.7 python3-pip && \ - pip3 install pre-commit==${PRE_COMMIT_VERSION} && \ - curl -L "$(curl -s https://api.github.com/repos/terraform-docs/terraform-docs/releases | grep -o -E "https://.+?${TERRAFORM_DOCS_VERSION}-linux-amd64.tar.gz")" > terraform-docs.tgz && tar xzf terraform-docs.tgz && chmod +x terraform-docs && mv terraform-docs /usr/bin/ && \ - curl -L "$(curl -s https://api.github.com/repos/terraform-linters/tflint/releases | grep -o -E "https://.+?/${TFLINT_VERSION}/tflint_linux_amd64.zip")" > tflint.zip && unzip tflint.zip && rm tflint.zip && mv tflint /usr/bin/ && \ - curl -L "$(curl -s https://api.github.com/repos/tfsec/tfsec/releases | grep -o -E "https://.+?/${TFSEC_VERSION}/tfsec-linux-amd64")" > tfsec && chmod +x tfsec && mv tfsec /usr/bin/ && \ - python3.7 -m pip install -U checkov==${CHECKOV_VERSION} +ARG PRE_COMMIT_VERSION=${PRE_COMMIT_VERSION:-latest} +ARG TERRAFORM_VERSION=${TERRAFORM_VERSION:-latest} + +# Install pre-commit +RUN [ ${PRE_COMMIT_VERSION} = "latest" ] && pip3 install --no-cache-dir pre-commit \ + || pip3 install --no-cache-dir pre-commit==${PRE_COMMIT_VERSION} # Install terraform because pre-commit needs it RUN curl -fsSL https://apt.releases.hashicorp.com/gpg | apt-key add - && \ apt-add-repository "deb [arch=amd64] https://apt.releases.hashicorp.com $(lsb_release -cs) main" && \ - apt-get update && apt-get install terraform=${TERRAFORM_VERSION} - -# Checking all binaries are in the PATH -RUN terraform --help -RUN pre-commit --help -RUN terraform-docs --help -RUN tflint --help -RUN tfsec --help -RUN checkov --help + apt update && \ + ( \ + [ "$TERRAFORM_VERSION" = "latest" ] && apt install -y terraform \ + || apt install -y terraform=${TERRAFORM_VERSION} \ + ) && \ + # Cleanup + rm -rf /var/lib/apt/lists/* + +# +# Install tools +# +WORKDIR /bin_dir + +ARG CHECKOV_VERSION=${CHECKOV_VERSION:-false} +ARG TERRAFORM_DOCS_VERSION=${TERRAFORM_DOCS_VERSION:-false} +ARG TERRAGRUNT_VERSION=${TERRAGRUNT_VERSION:-false} +ARG TERRASCAN_VERSION=${TERRASCAN_VERSION:-false} +ARG TFLINT_VERSION=${TFLINT_VERSION:-false} +ARG TFSEC_VERSION=${TFSEC_VERSION:-false} + + +# Tricky thing to install all tools by set only one arg. +# In RUN command below used `. /.env` <- this is sourcing vars that +# specified in step below +ARG INSTALL_ALL=${INSTALL_ALL:-false} +RUN if [ "$INSTALL_ALL" != "false" ]; then \ + echo "export CHECKOV_VERSION=latest" >> /.env && \ + echo "export TERRAFORM_DOCS_VERSION=latest" >> /.env && \ + echo "export TERRAGRUNT_VERSION=latest" >> /.env && \ + echo "export TERRASCAN_VERSION=latest" >> /.env && \ + echo "export TFLINT_VERSION=latest" >> /.env && \ + echo "export TFSEC_VERSION=latest" >> /.env \ + ; fi + + +# Checkov +RUN . /.env && \ + if [ "$CHECKOV_VERSION" != "false" ]; then \ + ( \ + [ "$CHECKOV_VERSION" = "latest" ] && pip3 install --no-cache-dir checkov \ + || pip3 install --no-cache-dir checkov==${CHECKOV_VERSION} \ + ) \ + ; fi + +# Terraform docs +RUN . /.env && \ + if [ "$TERRAFORM_DOCS_VERSION" != "false" ]; then \ + ( \ + TERRAFORM_DOCS_RELEASES="https://api.github.com/repos/terraform-docs/terraform-docs/releases" && \ + [ "$TERRAFORM_DOCS_VERSION" = "latest" ] && curl -L "$(curl -s ${TERRAFORM_DOCS_RELEASES}/latest | grep -o -E "https://.+?-linux-amd64.tar.gz")" > terraform-docs.tgz \ + || curl -L "$(curl -s ${TERRAFORM_DOCS_RELEASES} | grep -o -E "https://.+?v${TERRAFORM_DOCS_VERSION}-linux-amd64.tar.gz")" > terraform-docs.tgz \ + ) && tar -xzf terraform-docs.tgz terraform-docs && chmod +x terraform-docs \ + ; fi + +# Terragrunt +RUN . /.env \ + && if [ "$TERRAGRUNT_VERSION" != "false" ]; then \ + ( \ + TERRAGRUNT_RELEASES="https://api.github.com/repos/gruntwork-io/terragrunt/releases" && \ + [ "$TERRAGRUNT_VERSION" = "latest" ] && curl -L "$(curl -s ${TERRAGRUNT_RELEASES}/latest | grep -o -E "https://.+?/terragrunt_linux_amd64" | head -n 1)" > terragrunt \ + || curl -L "$(curl -s ${TERRAGRUNT_RELEASES} | grep -o -E "https://.+?v${TERRAGRUNT_VERSION}/terragrunt_linux_amd64" | head -n 1)" > terragrunt \ + ) && chmod +x terragrunt \ + ; fi + + +# Terrascan +RUN . /.env && \ + if [ "$TERRASCAN_VERSION" != "false" ]; then \ + ( \ + TERRASCAN_RELEASES="https://api.github.com/repos/accurics/terrascan/releases" && \ + [ "$TERRASCAN_VERSION" = "latest" ] && curl -L "$(curl -s ${TERRASCAN_RELEASES}/latest | grep -o -E "https://.+?_Linux_x86_64.tar.gz")" > terrascan.tar.gz \ + || curl -L "$(curl -s ${TERRASCAN_RELEASES} | grep -o -E "https://.+?${TERRASCAN_VERSION}_Linux_x86_64.tar.gz")" > terrascan.tar.gz \ + ) && tar -xzf terrascan.tar.gz terrascan && rm terrascan.tar.gz && \ + ./terrascan init \ + ; fi + +# TFLint +RUN . /.env && \ + if [ "$TFLINT_VERSION" != "false" ]; then \ + ( \ + TFLINT_RELEASES="https://api.github.com/repos/terraform-linters/tflint/releases" && \ + [ "$TFLINT_VERSION" = "latest" ] && curl -L "$(curl -s ${TFLINT_RELEASES}/latest | grep -o -E "https://.+?_linux_amd64.zip")" > tflint.zip \ + || curl -L "$(curl -s ${TFLINT_RELEASES} | grep -o -E "https://.+?/v${TFLINT_VERSION}/tflint_linux_amd64.zip")" > tflint.zip \ + ) && unzip tflint.zip && rm tflint.zip \ + ; fi + +# TFSec +RUN . /.env && \ + if [ "$TFSEC_VERSION" != "false" ]; then \ + ( \ + TFSEC_RELEASES="https://api.github.com/repos/aquasecurity/tfsec/releases" && \ + [ "$TFSEC_VERSION" = "latest" ] && curl -L "$(curl -s ${TFSEC_RELEASES}/latest | grep -o -E "https://.+?/tfsec-linux-amd64" | head -n 1)" > tfsec \ + || curl -L "$(curl -s ${TFSEC_RELEASES} | grep -o -E "https://.+?v${TFSEC_VERSION}/tfsec-linux-amd64" | head -n 1)" > tfsec \ + ) && chmod +x tfsec \ + ; fi + +# Checking binaries versions +RUN . /.env && \ + echo "\n\n" && \ + pre-commit --version && \ + terraform --version | head -n 1 && \ + (if [ "$CHECKOV_VERSION" != "false" ]; then echo -n "checkov " && checkov --version; else echo "checkov SKIPPED" ; fi) && \ + (if [ "$TERRAFORM_DOCS_VERSION" != "false" ]; then ./terraform-docs --version; else echo "terraform-docs SKIPPED"; fi) && \ + (if [ "$TERRAGRUNT_VERSION" != "false" ]; then ./terragrunt --version; else echo "terragrunt SKIPPED" ; fi) && \ + (if [ "$TERRASCAN_VERSION" != "false" ]; then echo -n "terrascan " && ./terrascan version; else echo "terrascan SKIPPED" ; fi) && \ + (if [ "$TFLINT_VERSION" != "false" ]; then ./tflint --version; else echo "tflint SKIPPED" ; fi) && \ + (if [ "$TFSEC_VERSION" != "false" ]; then echo -n "tfsec " && ./tfsec --version; else echo "tfsec SKIPPED" ; fi) && \ + echo "\n\n" + +# based on debian:buster-slim +# https://github.com/docker-library/python/blob/master/3.9/buster/slim/Dockerfile +FROM python:3.9-slim-buster + +# Python 3.8 (ubuntu 20.04) -> Python3.9 hacks +COPY --from=builder /usr/local/lib/python3.8/dist-packages/ /usr/local/lib/python3.9/site-packages/ +COPY --from=builder /usr/lib/python3/dist-packages /usr/local/lib/python3.9/site-packages +RUN mkdir /usr/lib/python3 && \ + ln -s /usr/local/lib/python3.9/site-packages /usr/lib/python3/site-packages && \ + ln -s /usr/local/bin/python3 /usr/bin/python3 +# Copy binaries needed for pre-commit +COPY --from=builder /usr/lib/git-core/ /usr/lib/git-core/ +COPY --from=builder /usr/lib/x86_64-linux-gnu/libpcre2-8.so.0 /usr/lib/x86_64-linux-gnu/ +# Copy tools +COPY --from=builder \ + /bin_dir/ \ + /usr/bin/terraform \ + /usr/local/bin/checkov* \ + /usr/local/bin/pre-commit \ + /usr/bin/git \ + /usr/bin/git-shell \ + /usr/bin/ +# Copy terrascan policies +COPY --from=builder /root/ /root/ + +ENV PRE_COMMIT_COLOR=${PRE_COMMIT_COLOR:-always} ENTRYPOINT [ "pre-commit" ] diff --git a/README.md b/README.md index 8852df7d1..19901f3d9 100644 --- a/README.md +++ b/README.md @@ -4,9 +4,6 @@ * [How to install](#how-to-install) * [1. Install dependencies](#1-install-dependencies) - * [MacOS](#macos) - * [Ubuntu 18.04](#ubuntu-1804) - * [Ubuntu 20.04](#ubuntu-2004) * [2. Install the pre-commit hook globally](#2-install-the-pre-commit-hook-globally) * [3. Add configs and hooks](#3-add-configs-and-hooks) * [4. Run](#4-run) @@ -25,23 +22,69 @@ ### 1. Install dependencies -* [`pre-commit`](https://pre-commit.com/#install) -* [`terraform-docs`](https://github.com/terraform-docs/terraform-docs) required for `terraform_docs` hooks. `GNU awk` is required if using `terraform-docs` older than 0.8.0 with Terraform 0.12. -* [`TFLint`](https://github.com/terraform-linters/tflint) required for `terraform_tflint` hook. -* [`TFSec`](https://github.com/liamg/tfsec) required for `terraform_tfsec` hook. -* [`coreutils`](https://formulae.brew.sh/formula/coreutils) required for `terraform_validate` hook on macOS (due to use of `realpath`). + + +* [`pre-commit`](https://pre-commit.com/#install), + [`terraform`](https://www.terraform.io/downloads.html), + [`git`](https://git-scm.com/downloads), + POSIX compatible shell, + Internet connection (on first run), + x86_64 compatible operation system, + Some hardware where this OS will run, + Electricity for hardware and internet connection, + Some basic physical laws, + Hope that it all will works. +

* [`checkov`](https://github.com/bridgecrewio/checkov) required for `checkov` hook. +* [`terraform-docs`](https://github.com/terraform-docs/terraform-docs) required for `terraform_docs` hooks. * [`terrascan`](https://github.com/accurics/terrascan) required for `terrascan` hook. +* [`TFLint`](https://github.com/terraform-linters/tflint) required for `terraform_tflint` hook. +* [`TFSec`](https://github.com/liamg/tfsec) required for `terraform_tfsec` hook. + +
Docker
+ +If no `--build-arg` is specified, then the latest versions of `pre-commit` and `terraform` will be installed. + +```bash +git clone git@github.com:antonbabenko/pre-commit-terraform.git +cd pre-commit-terraform +# Install all tools with latest versions: +docker build -t pre-commit --build-arg INSTALL_ALL=true . +``` + +You can specify needed tool versions by providing `--build-arg`'s. +If you'd like you can use the `latest` versions: + +```bash +docker build -t pre-commit \ + --build-arg PRE_COMMIT_VERSION=latest \ + --build-arg TERRAFORM_VERSION=latest \ + --build-arg CHECKOV_VERSION=2.0.405 \ + --build-arg TERRAFORM_DOCS_VERSION=0.15.0 \ + --build-arg TERRAGRUNT_VERSION=latest \ + --build-arg TERRASCAN_VERSION=1.10.0 \ + --build-arg TFLINT_VERSION=0.31.0 \ + --build-arg TFSEC_VERSION=latest \ + . +``` -or build and use the Docker image locally as mentioned below in the `Run` section. +To disable pre-commit color output set `-e PRE_COMMIT_COLOR=never`. -#### MacOS +
+ + +
MacOS
+ +[`coreutils`](https://formulae.brew.sh/formula/coreutils) required for `terraform_validate` hook on macOS (due to use of `realpath`). ```bash brew install pre-commit gawk terraform-docs tflint tfsec coreutils checkov terrascan +terrascan init ``` -#### Ubuntu 18.04 +
+ +
Ubuntu 18.04
```bash sudo apt update @@ -49,33 +92,40 @@ sudo apt install -y gawk unzip software-properties-common sudo add-apt-repository ppa:deadsnakes/ppa sudo apt install -y python3.7 python3-pip python3 -m pip install --upgrade pip -pip3 install pre-commit +pip3 install --no-cache-dir pre-commit +python3.7 -m pip install -U checkov curl -L "$(curl -s https://api.github.com/repos/terraform-docs/terraform-docs/releases/latest | grep -o -E "https://.+?-linux-amd64.tar.gz")" > terraform-docs.tgz && tar xzf terraform-docs.tgz && chmod +x terraform-docs && sudo mv terraform-docs /usr/bin/ curl -L "$(curl -s https://api.github.com/repos/terraform-linters/tflint/releases/latest | grep -o -E "https://.+?_linux_amd64.zip")" > tflint.zip && unzip tflint.zip && rm tflint.zip && sudo mv tflint /usr/bin/ curl -L "$(curl -s https://api.github.com/repos/aquasecurity/tfsec/releases/latest | grep -o -E "https://.+?tfsec-linux-amd64" | head -n 1)" > tfsec && chmod +x tfsec && sudo mv tfsec /usr/bin/ curl -L "$(curl -s https://api.github.com/repos/accurics/terrascan/releases/latest | grep -o -E "https://.+?_Linux_x86_64.tar.gz")" > terrascan.tar.gz && tar -xf terrascan.tar.gz terrascan && rm terrascan.tar.gz && sudo mv terrascan /usr/bin/ -python3.7 -m pip install -U checkov +terrascan init ``` -##### Ubuntu 20.04 +
+ + +
Ubuntu 20.04
```bash sudo apt update -sudo apt install -y gawk unzip software-properties-common -sudo apt install -y python3 python3-pip +sudo apt install -y gawk unzip software-properties-common python3 python3-pip python3 -m pip install --upgrade pip -pip3 install pre-commit +pip3 install --no-cache-dir pre-commit +pip3 install --no-cache-dir checkov curl -L "$(curl -s https://api.github.com/repos/terraform-docs/terraform-docs/releases/latest | grep -o -E "https://.+?-linux-amd64.tar.gz")" > terraform-docs.tgz && tar -xzf terraform-docs.tgz terraform-docs && chmod +x terraform-docs && sudo mv terraform-docs /usr/bin/ +curl -L "$(curl -s https://api.github.com/repos/accurics/terrascan/releases/latest | grep -o -E "https://.+?_Linux_x86_64.tar.gz")" > terrascan.tar.gz && tar -xf terrascan.tar.gz terrascan && rm terrascan.tar.gz && sudo mv terrascan /usr/bin/ +terrascan init curl -L "$(curl -s https://api.github.com/repos/terraform-linters/tflint/releases/latest | grep -o -E "https://.+?_linux_amd64.zip")" > tflint.zip && unzip tflint.zip && rm tflint.zip && sudo mv tflint /usr/bin/ curl -L "$(curl -s https://api.github.com/repos/aquasecurity/tfsec/releases/latest | grep -o -E "https://.+?tfsec-linux-amd64" | head -n 1)" > tfsec && chmod +x tfsec && sudo mv tfsec /usr/bin/ -curl -L "$(curl -s https://api.github.com/repos/accurics/terrascan/releases/latest | grep -o -E "https://.+?_Linux_x86_64.tar.gz")" > terrascan.tar.gz && tar -xf terrascan.tar.gz terrascan && rm terrascan.tar.gz && sudo mv terrascan /usr/bin/ -pip3 install -U checkov ``` +
+ + ### 2. Install the pre-commit hook globally -Note: not needed if you use the Docker image +> Note: not needed if you use the Docker image ```bash DIR=~/.git-template @@ -101,19 +151,17 @@ EOF ### 4. Run -After pre-commit hook has been installed you can run it manually on all files in the repository +After pre-commit hook has been installed you can run it manually on all files in the repository. + +Local installation: ```bash pre-commit run -a ``` -or you can also build and use the provided Docker container, which wraps all dependencies by +Docker: ```bash -# first building it -docker build -t pre-commit . -# and then running it in the folder -# with the terraform code you want to check by executing docker run -v $(pwd):/lint -w /lint pre-commit run -a ``` @@ -121,19 +169,19 @@ docker run -v $(pwd):/lint -w /lint pre-commit run -a There are several [pre-commit](https://pre-commit.com/) hooks to keep Terraform configurations (both `*.tf` and `*.tfvars`) and Terragrunt configurations (`*.hcl`) in a good shape: -| Hook name | Description | -| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------ | -| `terraform_fmt` | Rewrites all Terraform configuration files to a canonical format. [Hook notes](#terraform_docs) | -| `terraform_validate` | Validates all Terraform configuration files. [Hook notes](#terraform_validate) | -| `terraform_docs` | Inserts input and output documentation into `README.md`. Recommended. | -| `terraform_docs_without_aggregate_type_defaults` | Inserts input and output documentation into `README.md` without aggregate type defaults. | -| `terraform_docs_replace` | Runs `terraform-docs` and pipes the output directly to README.md | -| `terraform_tflint` | Validates all Terraform configuration files with [TFLint](https://github.com/terraform-linters/tflint). [Hook notes](#terraform_tflint). | -| `terragrunt_fmt` | Rewrites all [Terragrunt](https://github.com/gruntwork-io/terragrunt) configuration files (`*.hcl`) to a canonical format. | -| `terragrunt_validate` | Validates all [Terragrunt](https://github.com/gruntwork-io/terragrunt) configuration files (`*.hcl`) | -| `terraform_tfsec` | [TFSec](https://github.com/liamg/tfsec) static analysis of terraform templates to spot potential security issues. [Hook notes](#terraform_tfsec) | -| `checkov` | [checkov](https://github.com/bridgecrewio/checkov) static analysis of terraform templates to spot potential security issues. | -| `terrascan` | [terrascan](https://github.com/accurics/terrascan) Detect compliance and security violations. | +| Hook name | Description | +| ------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `terraform_fmt` | Rewrites all Terraform configuration files to a canonical format. [Hook notes](#terraform_docs) | +| `terraform_validate` | Validates all Terraform configuration files. [Hook notes](#terraform_validate) | +| `terraform_docs` | Inserts input and output documentation into `README.md`. Recommended. | +| `terraform_docs_without_aggregate_type_defaults` | Inserts input and output documentation into `README.md` without aggregate type defaults. | +| `terraform_docs_replace` | Runs `terraform-docs` and pipes the output directly to README.md | +| `terraform_tflint` | Validates all Terraform configuration files with [TFLint](https://github.com/terraform-linters/tflint). [Available TFLint rules](https://github.com/terraform-linters/tflint/tree/master/docs/rules#rules). [Hook notes](#terraform_tflint). | +| `terragrunt_fmt` | Rewrites all [Terragrunt](https://github.com/gruntwork-io/terragrunt) configuration files (`*.hcl`) to a canonical format. | +| `terragrunt_validate` | Validates all [Terragrunt](https://github.com/gruntwork-io/terragrunt) configuration files (`*.hcl`) | +| `terraform_tfsec` | [TFSec](https://github.com/liamg/tfsec) static analysis of terraform templates to spot potential security issues. [Hook notes](#terraform_tfsec) | +| `checkov` | [checkov](https://github.com/bridgecrewio/checkov) static analysis of terraform templates to spot potential security issues. | +| `terrascan` | [terrascan](https://github.com/accurics/terrascan) Detect compliance and security violations. | Check the [source file](https://github.com/antonbabenko/pre-commit-terraform/blob/master/.pre-commit-hooks.yaml) to know arguments used for each hook.