Skip to content

Commit bbccc95

Browse files
rberlindrberlind
committed
added 0.12 test cases for cloud-agnostic
1 parent db23875 commit bbccc95

File tree

9 files changed

+288
-26
lines changed

9 files changed

+288
-26
lines changed

‎governance/second-generation/README.md

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,11 @@ Also be sure to temporarily set the attributes you are testing to be computed in
4444
### Policies that Use the tfconfig or tfstate Imports
4545
Most of the second-generation policies and functions currently use the `tfplan` import. However, the cloud-agnostic policy [prevent-remote-exec-provisioners-on-null-resources](./cloud-agnostic/prevent-remote-exec-provisioners-on-null-resources.sentinel) policy uses the `tfconfig` import while the Azure policy [restrict-publishers-of-current-vms](./azure/restrict-publishers-of-current-vms.sentinel) policy uses the `tfstate` import.
4646

47-
New policies that use the tfconfig import will require the addition of mock-tfconfig-pass.sentinel and mock-tfconfig-fail.sentinel files that mock the configuration of relevant resources. Policies that use the tfstate import will require the addition of mock-tfstate-pass.sentinel and mock-tfstate-fail.sentinel files that mock the state of relevant resources. The pass.json and fail.json files would have to be modified to refer to these additional mock files. You can look at the test cases of the two policies mentioned to see how these files should be configured. Note that unlike the `tfplan` and `tfstate` imports, the `tfconfig` import does not have a `terraform_version` key, so there is no need to create 0.11 and 0.12 mocks for policies that use the `tfconfig` import.
47+
New policies that use the tfconfig import will require the addition of pass-0.11.json, pass-0.12.json, fail-0.11.json, fail-0.12.json, mock-tfconfig-pass-0.11.sentinel, mock-tfconfig-pass-0.12.sentinel, mock-tfconfig-fail-0.11.sentinel and mock-tfconfig-fail0.12.sentinel files that mock the configuration of relevant resources.
48+
49+
Policies that use the tfstate import will require the addition of pass-0.11.json, pass-0.12.json, fail-0.11.json, fail-0.12.json, mock-tfstate-pass-0.11.sentinel, mock-tfstate-pass-0.12.sentinel, mock-tfstate-fail-0.11.sentinel and mock-tfstate-fail0.12.sentinel files that mock the state of relevant resources.
50+
51+
You can look at the test cases of the two policies mentioned to see how these files should be configured. Note that unlike the `tfplan` and `tfstate` imports, the `tfconfig` import does not have a `terraform_version` key; however, you should still generate 0.11 and 0.12 test cases and mocks since the mocks generated from Terraform 0.12 plans will differ from those generated from 0.11 plans.
4852

4953
## Terraform Support
50-
Most of these policies have been tested with Terraform 0.11.14 and 0.12.3.
54+
Most of these policies have been tested with Terraform 0.11.13 or 0.11.14 and 0.12.3.

‎governance/second-generation/cloud-agnostic/test/prevent-remote-exec-provisioners-on-null-resources/fail.json renamed to ‎governance/second-generation/cloud-agnostic/test/prevent-remote-exec-provisioners-on-null-resources/fail-0.11.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"mock": {
3-
"tfconfig": "mock-tfconfig-fail.sentinel"
3+
"tfconfig": "mock-tfconfig-fail-0.11.sentinel"
44
},
55
"test": {
66
"main": false

‎governance/second-generation/cloud-agnostic/test/prevent-remote-exec-provisioners-on-null-resources/fail-0.12.json

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"mock": {
3+
"tfconfig": "mock-tfconfig-fail-0.12.sentinel"
4+
},
5+
"test": {
6+
"main": false
7+
}
8+
}

‎governance/second-generation/cloud-agnostic/test/prevent-remote-exec-provisioners-on-null-resources/mock-tfconfig-fail.sentinel renamed to ‎governance/second-generation/cloud-agnostic/test/prevent-remote-exec-provisioners-on-null-resources/mock-tfconfig-fail-0.11.sentinel

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,11 @@ _modules = {
3030
"associate_public_ip_address": "true",
3131
"availability_zone": "${var.aws_region}b",
3232
"instance_type": "${var.instance_type}",
33-
"key_name": "${var.key_name}",
3433
"tags": [
3534
{
3635
"Name": "${var.name}",
3736
"owner": "[email protected]",
38-
"ttl": "24",
37+
"ttl": "48",
3938
},
4039
],
4140
},
@@ -49,7 +48,7 @@ _modules = {
4948
{
5049
"config": {
5150
"inline": [
52-
"ls",
51+
"${var.command}",
5352
],
5453
},
5554
"type": "remote-exec",
@@ -67,22 +66,18 @@ _modules = {
6766
"default": "us-east-1",
6867
"description": "AWS region",
6968
},
69+
"command": {
70+
"default": "ls",
71+
"description": "",
72+
},
7073
"instance_type": {
7174
"default": "t2.micro",
7275
"description": "type of EC2 instance to provision.",
7376
},
74-
"key_name": {
75-
"default": null,
76-
"description": "name of private key",
77-
},
7877
"name": {
7978
"default": "Provisioned by Terraform",
8079
"description": "name to pass to Name tag",
8180
},
82-
"private_key_data": {
83-
"default": null,
84-
"description": "private key data",
85-
},
8681
},
8782
},
8883
}

‎governance/second-generation/cloud-agnostic/test/prevent-remote-exec-provisioners-on-null-resources/mock-tfconfig-fail-0.12.sentinel

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
import "strings"
2+
import "types"
3+
4+
_modules = {
5+
"root": {
6+
"data": {},
7+
"modules": {},
8+
"outputs": {
9+
"public_dns": {
10+
"depends_on": [],
11+
"description": "",
12+
"references": [
13+
"aws_instance.ubuntu",
14+
],
15+
"sensitive": false,
16+
"value": undefined,
17+
},
18+
},
19+
"providers": {
20+
"aws": {
21+
"alias": {},
22+
"config": {},
23+
"references": {
24+
"region": [
25+
"var.aws_region",
26+
],
27+
},
28+
"version": "",
29+
},
30+
},
31+
"resources": {
32+
"aws_instance": {
33+
"ubuntu": {
34+
"config": {
35+
"associate_public_ip_address": "true",
36+
},
37+
"provisioners": null,
38+
"references": {
39+
"ami": [
40+
"var.ami_id",
41+
],
42+
"associate_public_ip_address": [],
43+
"availability_zone": [
44+
"var.aws_region",
45+
],
46+
"instance_type": [
47+
"var.instance_type",
48+
],
49+
"tags": [
50+
"var.name",
51+
],
52+
},
53+
},
54+
},
55+
"null_resource": {
56+
"post_install": {
57+
"config": {},
58+
"provisioners": [
59+
{
60+
"config": {},
61+
"references": {
62+
"inline": [
63+
"var.command",
64+
],
65+
},
66+
"type": "remote-exec",
67+
},
68+
],
69+
"references": {},
70+
},
71+
},
72+
},
73+
"variables": {
74+
"ami_id": {
75+
"default": "ami-2e1ef954",
76+
"description": "ID of the AMI to provision. Default is Ubuntu 14.04 Base Image",
77+
},
78+
"aws_region": {
79+
"default": "us-east-1",
80+
"description": "AWS region",
81+
},
82+
"command": {
83+
"default": "ls",
84+
"description": "",
85+
},
86+
"instance_type": {
87+
"default": "t2.micro",
88+
"description": "type of EC2 instance to provision.",
89+
},
90+
"name": {
91+
"default": "Provisioned by Terraform",
92+
"description": "name to pass to Name tag",
93+
},
94+
},
95+
},
96+
}
97+
98+
module_paths = [
99+
[],
100+
]
101+
102+
module = func(path) {
103+
if types.type_of(path) is not "list" {
104+
error("expected list, got", types.type_of(path))
105+
}
106+
107+
if length(path) < 1 {
108+
return _modules.root
109+
}
110+
111+
addr = []
112+
for path as p {
113+
append(addr, "module")
114+
append(addr, p)
115+
}
116+
117+
return _modules[strings.join(addr, ".")]
118+
}
119+
120+
data = _modules.root.data
121+
modules = _modules.root.modules
122+
providers = _modules.root.providers
123+
resources = _modules.root.resources
124+
variables = _modules.root.variables
125+
outputs = _modules.root.outputs

‎governance/second-generation/cloud-agnostic/test/prevent-remote-exec-provisioners-on-null-resources/mock-tfconfig-pass.sentinel renamed to ‎governance/second-generation/cloud-agnostic/test/prevent-remote-exec-provisioners-on-null-resources/mock-tfconfig-pass-0.11.sentinel

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,11 @@ _modules = {
3030
"associate_public_ip_address": "true",
3131
"availability_zone": "${var.aws_region}b",
3232
"instance_type": "${var.instance_type}",
33-
"key_name": "${var.key_name}",
3433
"tags": [
3534
{
3635
"Name": "${var.name}",
3736
"owner": "[email protected]",
38-
"ttl": "24",
37+
"ttl": "48",
3938
},
4039
],
4140
},
@@ -48,7 +47,9 @@ _modules = {
4847
"provisioners": [
4948
{
5049
"config": {
51-
"command": "ls",
50+
"command": [
51+
"${var.command}",
52+
],
5253
},
5354
"type": "local-exec",
5455
},
@@ -65,22 +66,18 @@ _modules = {
6566
"default": "us-east-1",
6667
"description": "AWS region",
6768
},
69+
"command": {
70+
"default": "ls",
71+
"description": "",
72+
},
6873
"instance_type": {
6974
"default": "t2.micro",
7075
"description": "type of EC2 instance to provision.",
7176
},
72-
"key_name": {
73-
"default": null,
74-
"description": "name of private key",
75-
},
7677
"name": {
7778
"default": "Provisioned by Terraform",
7879
"description": "name to pass to Name tag",
7980
},
80-
"private_key_data": {
81-
"default": null,
82-
"description": "private key data",
83-
},
8481
},
8582
},
8683
}

‎governance/second-generation/cloud-agnostic/test/prevent-remote-exec-provisioners-on-null-resources/mock-tfconfig-pass-0.12.sentinel

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
import "strings"
2+
import "types"
3+
4+
_modules = {
5+
"root": {
6+
"data": {},
7+
"modules": {},
8+
"outputs": {
9+
"public_dns": {
10+
"depends_on": [],
11+
"description": "",
12+
"references": [
13+
"aws_instance.ubuntu",
14+
],
15+
"sensitive": false,
16+
"value": undefined,
17+
},
18+
},
19+
"providers": {
20+
"aws": {
21+
"alias": {},
22+
"config": {},
23+
"references": {
24+
"region": [
25+
"var.aws_region",
26+
],
27+
},
28+
"version": "",
29+
},
30+
},
31+
"resources": {
32+
"aws_instance": {
33+
"ubuntu": {
34+
"config": {
35+
"associate_public_ip_address": "true",
36+
},
37+
"provisioners": null,
38+
"references": {
39+
"ami": [
40+
"var.ami_id",
41+
],
42+
"associate_public_ip_address": [],
43+
"availability_zone": [
44+
"var.aws_region",
45+
],
46+
"instance_type": [
47+
"var.instance_type",
48+
],
49+
"tags": [
50+
"var.name",
51+
],
52+
},
53+
},
54+
},
55+
"null_resource": {
56+
"post_install": {
57+
"config": {},
58+
"provisioners": [
59+
{
60+
"config": {},
61+
"references": {
62+
"command": [
63+
"var.command",
64+
],
65+
},
66+
"type": "local-exec",
67+
},
68+
],
69+
"references": {},
70+
},
71+
},
72+
},
73+
"variables": {
74+
"ami_id": {
75+
"default": "ami-2e1ef954",
76+
"description": "ID of the AMI to provision. Default is Ubuntu 14.04 Base Image",
77+
},
78+
"aws_region": {
79+
"default": "us-east-1",
80+
"description": "AWS region",
81+
},
82+
"command": {
83+
"default": "ls",
84+
"description": "",
85+
},
86+
"instance_type": {
87+
"default": "t2.micro",
88+
"description": "type of EC2 instance to provision.",
89+
},
90+
"name": {
91+
"default": "Provisioned by Terraform",
92+
"description": "name to pass to Name tag",
93+
},
94+
},
95+
},
96+
}
97+
98+
module_paths = [
99+
[],
100+
]
101+
102+
module = func(path) {
103+
if types.type_of(path) is not "list" {
104+
error("expected list, got", types.type_of(path))
105+
}
106+
107+
if length(path) < 1 {
108+
return _modules.root
109+
}
110+
111+
addr = []
112+
for path as p {
113+
append(addr, "module")
114+
append(addr, p)
115+
}
116+
117+
return _modules[strings.join(addr, ".")]
118+
}
119+
120+
data = _modules.root.data
121+
modules = _modules.root.modules
122+
providers = _modules.root.providers
123+
resources = _modules.root.resources
124+
variables = _modules.root.variables
125+
outputs = _modules.root.outputs

‎governance/second-generation/cloud-agnostic/test/prevent-remote-exec-provisioners-on-null-resources/pass.json renamed to ‎governance/second-generation/cloud-agnostic/test/prevent-remote-exec-provisioners-on-null-resources/pass-0.11.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"mock": {
3-
"tfconfig": "mock-tfconfig-pass.sentinel"
3+
"tfconfig": "mock-tfconfig-pass-0.11.sentinel"
44
},
55
"test": {
66
"main": true

0 commit comments

Comments
 (0)