Skip to content

Commit be67890

Browse files
rberlindrberlind
authored
Merge pull request hashicorp#130 from hashicorp/fix-sentinel-resource-destruction-checks
Fix sentinel resource destruction checks
2 parents ea126da + fe22128 commit be67890

File tree

87 files changed

+229
-56
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

87 files changed

+229
-56
lines changed

‎governance/second-generation/aws/enforce-mandatory-tags.sentinel

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,8 +55,9 @@ validate_attribute_contains_list = func(type, attribute, required_values) {
5555
for resource_instances as address, r {
5656

5757
# Skip resource instances that are being destroyed
58-
# to avoid unnecessary policy violations
59-
if length(r.diff) == 0 {
58+
# to avoid unnecessary policy violations.
59+
# Used to be: if length(r.diff) == 0
60+
if r.destroy {
6061
print("Skipping resource", address, "that is being destroyed.")
6162
continue
6263
}

‎governance/second-generation/aws/mocks/ec2-instance-mock-tfplan.sentinel

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ _modules = {
5555
"volume_tags": {},
5656
"vpc_security_group_ids": "74D93920-ED26-11E3-AC10-0800200C9A66",
5757
},
58+
"destroy": false,
5859
"diff": {
5960
"ami": {
6061
"computed": false,
@@ -318,6 +319,7 @@ _modules = {
318319
"volume_tags": {},
319320
"vpc_security_group_ids": "74D93920-ED26-11E3-AC10-0800200C9A66",
320321
},
322+
"destroy": false,
321323
"diff": {
322324
"ami": {
323325
"computed": false,
@@ -582,6 +584,7 @@ _modules = {
582584
"volume_tags": {},
583585
"vpc_security_group_ids": "74D93920-ED26-11E3-AC10-0800200C9A66",
584586
},
587+
"destroy": false,
585588
"diff": {
586589
"ami": {
587590
"computed": false,
@@ -834,4 +837,4 @@ module = func(path) {
834837

835838
data = _modules.root.data
836839
path = _modules.root.path
837-
resources = _modules.root.resources
840+
resources = _modules.root.resources

‎governance/second-generation/aws/mocks/launch-configuration-mock-tfplan.sentinel

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ _modules = {
2020
"name": "web_config",
2121
"root_block_device": "74D93920-ED26-11E3-AC10-0800200C9A66",
2222
},
23+
"destroy": false,
2324
"diff": {
2425
"associate_public_ip_address": {
2526
"computed": false,
@@ -97,4 +98,4 @@ module = func(path) {
9798

9899
data = _modules.root.data
99100
path = _modules.root.path
100-
resources = _modules.root.resources
101+
resources = _modules.root.resources

‎governance/second-generation/aws/mocks/rds-db-instance-mock-tfplan.sentinel

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ _modules = {
5050
"username": "foo",
5151
"vpc_security_group_ids": "74D93920-ED26-11E3-AC10-0800200C9A66",
5252
},
53+
"destroy": false,
5354
"diff": {
5455
"address": {
5556
"computed": true,
@@ -277,4 +278,4 @@ module = func(path) {
277278

278279
data = _modules.root.data
279280
path = _modules.root.path
280-
resources = _modules.root.resources
281+
resources = _modules.root.resources

‎governance/second-generation/aws/mocks/s3-bucket-mock-tfplan.sentinel

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@ _modules = {
6161
"website_domain": "74D93920-ED26-11E3-AC10-0800200C9A66",
6262
"website_endpoint": "74D93920-ED26-11E3-AC10-0800200C9A66",
6363
},
64+
"destroy": false,
6465
"diff": {
6566
"acceleration_status": {
6667
"computed": true,
@@ -267,4 +268,4 @@ module = func(path) {
267268

268269
data = _modules.root.data
269270
path = _modules.root.path
270-
resources = _modules.root.resources
271+
resources = _modules.root.resources

‎governance/second-generation/aws/mocks/sgr-mock-tfplan.sentinel

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ _modules = {
2121
"to_port": "65535",
2222
"type": "ingress",
2323
},
24+
"destroy": false,
2425
"diff": {
2526
"cidr_blocks.#": {
2627
"computed": false,
@@ -98,4 +99,4 @@ module = func(path) {
9899

99100
data = _modules.root.data
100101
path = _modules.root.path
101-
resources = _modules.root.resources
102+
resources = _modules.root.resources

‎governance/second-generation/aws/require-private-acl-and-kms-for-s3-buckets.sentinel

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,8 +57,9 @@ validate_private_acl_and_kms_encryption = func() {
5757
for resource_instances as address, r {
5858

5959
# Skip resources that are being destroyed
60-
# to avoid unnecessary policy violations
61-
if length(r.diff) == 0 {
60+
# to avoid unnecessary policy violations.
61+
# Used to be: if length(r.diff) == 0
62+
if r.destroy {
6263
print("Skipping resource", address, "that is being destroyed.")
6364
continue
6465
}

‎governance/second-generation/aws/restrict-availability-zones.sentinel

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,8 +53,9 @@ validate_attribute_in_list = func(type, attribute, allowed_values) {
5353
for resource_instances as address, r {
5454

5555
# Skip resource instances that are being destroyed
56-
# to avoid unnecessary policy violations
57-
if length(r.diff) == 0 {
56+
# to avoid unnecessary policy violations.
57+
# Used to be: if length(r.diff) == 0
58+
if r.destroy {
5859
print("Skipping resource", address, "that is being destroyed.")
5960
continue
6061
}

‎governance/second-generation/aws/restrict-db-instance-engines.sentinel

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,8 +52,9 @@ validate_attribute_in_list = func(type, attribute, allowed_values) {
5252
for resource_instances as address, r {
5353

5454
# Skip resource instances that are being destroyed
55-
# to avoid unnecessary policy violations
56-
if length(r.diff) == 0 {
55+
# to avoid unnecessary policy violations.
56+
# Used to be: if length(r.diff) == 0
57+
if r.destroy {
5758
print("Skipping resource", address, "that is being destroyed.")
5859
continue
5960
}

‎governance/second-generation/aws/restrict-ec2-instance-type.sentinel

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,8 +52,9 @@ validate_attribute_in_list = func(type, attribute, allowed_values) {
5252
for resource_instances as address, r {
5353

5454
# Skip resource instances that are being destroyed
55-
# to avoid unnecessary policy violations
56-
if length(r.diff) == 0 {
55+
# to avoid unnecessary policy violations.
56+
# Used to be: if length(r.diff) == 0
57+
if r.destroy {
5758
print("Skipping resource", address, "that is being destroyed.")
5859
continue
5960
}

‎governance/second-generation/aws/restrict-ingress-sg-rule-cidr-blocks.sentinel

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,8 +53,9 @@ validate_sgr_cidr_blocks = func() {
5353
for resource_instances as address, r {
5454

5555
# Skip resources that are being destroyed
56-
# to avoid unnecessary policy violations
57-
if length(r.diff) == 0 {
56+
# to avoid unnecessary policy violations.
57+
# Used to be: if length(r.diff) == 0
58+
if r.destroy {
5859
print("Skipping resource", address, "that is being destroyed.")
5960
continue
6061
}

‎governance/second-generation/aws/restrict-launch-configuration-instance-type.sentinel

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,8 +59,9 @@ validate_instance_types = func(allowed_types) {
5959
for resource_instances as address, r {
6060

6161
# Skip resource instances that are being destroyed
62-
# to avoid unnecessary policy violations
63-
if length(r.diff) == 0 {
62+
# to avoid unnecessary policy violations.
63+
# Used to be: if length(r.diff) == 0
64+
if r.destroy {
6465
print("Skipping resource", address, "that is being destroyed.")
6566
continue
6667
}

‎governance/second-generation/aws/test/enforce-mandatory-tags/mock-tfplan-fail-0.11.sentinel

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ _modules = {
5353
"volume_tags": {},
5454
"vpc_security_group_ids": "74D93920-ED26-11E3-AC10-0800200C9A66",
5555
},
56+
"destroy": false,
5657
"diff": {
5758
"ami": {
5859
"computed": false,
@@ -297,6 +298,7 @@ _modules = {
297298
"volume_tags": {},
298299
"vpc_security_group_ids": "74D93920-ED26-11E3-AC10-0800200C9A66",
299300
},
301+
"destroy": false,
300302
"diff": {
301303
"ami": {
302304
"computed": false,
@@ -544,6 +546,7 @@ _modules = {
544546
"volume_tags": {},
545547
"vpc_security_group_ids": "74D93920-ED26-11E3-AC10-0800200C9A66",
546548
},
549+
"destroy": false,
547550
"diff": {
548551
"ami": {
549552
"computed": false,
@@ -794,6 +797,7 @@ _modules = {
794797
"volume_tags": {},
795798
"vpc_security_group_ids": "74D93920-ED26-11E3-AC10-0800200C9A66",
796799
},
800+
"destroy": false,
797801
"diff": {
798802
"ami": {
799803
"computed": false,

‎governance/second-generation/aws/test/enforce-mandatory-tags/mock-tfplan-fail-0.12.sentinel

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ _modules = {
3131
"user_data": null,
3232
"user_data_base64": null,
3333
},
34+
"destroy": false,
3435
"diff": {
3536
"ami": {
3637
"computed": false,

‎governance/second-generation/aws/test/enforce-mandatory-tags/mock-tfplan-pass-0.11.sentinel

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@ _modules = {
5454
"volume_tags": {},
5555
"vpc_security_group_ids": "74D93920-ED26-11E3-AC10-0800200C9A66",
5656
},
57+
"destroy": false,
5758
"diff": {
5859
"ami": {
5960
"computed": false,
@@ -304,6 +305,7 @@ _modules = {
304305
"volume_tags": {},
305306
"vpc_security_group_ids": "74D93920-ED26-11E3-AC10-0800200C9A66",
306307
},
308+
"destroy": false,
307309
"diff": {
308310
"ami": {
309311
"computed": false,
@@ -556,6 +558,7 @@ _modules = {
556558
"volume_tags": {},
557559
"vpc_security_group_ids": "74D93920-ED26-11E3-AC10-0800200C9A66",
558560
},
561+
"destroy": false,
559562
"diff": {
560563
"ami": {
561564
"computed": false,
@@ -806,6 +809,7 @@ _modules = {
806809
"volume_tags": {},
807810
"vpc_security_group_ids": "74D93920-ED26-11E3-AC10-0800200C9A66",
808811
},
812+
"destroy": false,
809813
"diff": {
810814
"ami": {
811815
"computed": false,

‎governance/second-generation/aws/test/enforce-mandatory-tags/mock-tfplan-pass-0.12.sentinel

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ _modules = {
3232
"user_data": null,
3333
"user_data_base64": null,
3434
},
35+
"destroy": false,
3536
"diff": {
3637
"ami": {
3738
"computed": false,

‎governance/second-generation/aws/test/require-private-acl-and-kms-for-s3-buckets/mock-tfplan-fail-acl-0.11.sentinel

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@ _modules = {
6161
"website_domain": "74D93920-ED26-11E3-AC10-0800200C9A66",
6262
"website_endpoint": "74D93920-ED26-11E3-AC10-0800200C9A66",
6363
},
64+
"destroy": false,
6465
"diff": {
6566
"acceleration_status": {
6667
"computed": true,

‎governance/second-generation/aws/test/require-private-acl-and-kms-for-s3-buckets/mock-tfplan-fail-acl-and-kms-0.11.sentinel

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ _modules = {
6060
"website_domain": "74D93920-ED26-11E3-AC10-0800200C9A66",
6161
"website_endpoint": "74D93920-ED26-11E3-AC10-0800200C9A66",
6262
},
63+
"destroy": false,
6364
"diff": {
6465
"acceleration_status": {
6566
"computed": true,

‎governance/second-generation/aws/test/require-private-acl-and-kms-for-s3-buckets/mock-tfplan-fail-acl-and-kms-0.12.sentinel

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@ _modules = {
6262
"website_domain": "74D93920-ED26-11E3-AC10-0800200C9A66",
6363
"website_endpoint": "74D93920-ED26-11E3-AC10-0800200C9A66",
6464
},
65+
"destroy": false,
6566
"diff": {
6667
"acceleration_status": {
6768
"computed": true,

‎governance/second-generation/aws/test/require-private-acl-and-kms-for-s3-buckets/mock-tfplan-fail-kms-0.11.sentinel

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ _modules = {
4747
"website_domain": "74D93920-ED26-11E3-AC10-0800200C9A66",
4848
"website_endpoint": "74D93920-ED26-11E3-AC10-0800200C9A66",
4949
},
50+
"destroy": false,
5051
"diff": {
5152
"acceleration_status": {
5253
"computed": true,

‎governance/second-generation/aws/test/require-private-acl-and-kms-for-s3-buckets/mock-tfplan-pass-0.11.sentinel

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@ _modules = {
6161
"website_domain": "74D93920-ED26-11E3-AC10-0800200C9A66",
6262
"website_endpoint": "74D93920-ED26-11E3-AC10-0800200C9A66",
6363
},
64+
"destroy": false,
6465
"diff": {
6566
"acceleration_status": {
6667
"computed": true,

‎governance/second-generation/aws/test/require-private-acl-and-kms-for-s3-buckets/mock-tfplan-pass-0.12.sentinel

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@ _modules = {
6262
"website_domain": "74D93920-ED26-11E3-AC10-0800200C9A66",
6363
"website_endpoint": "74D93920-ED26-11E3-AC10-0800200C9A66",
6464
},
65+
"destroy": false,
6566
"diff": {
6667
"acceleration_status": {
6768
"computed": true,

‎governance/second-generation/aws/test/restrict-availability-zones/mock-tfplan-fail-0.11.sentinel

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ _modules = {
5353
"volume_tags": {},
5454
"vpc_security_group_ids": "74D93920-ED26-11E3-AC10-0800200C9A66",
5555
},
56+
"destroy": false,
5657
"diff": {
5758
"ami": {
5859
"computed": false,
@@ -297,6 +298,7 @@ _modules = {
297298
"volume_tags": {},
298299
"vpc_security_group_ids": "74D93920-ED26-11E3-AC10-0800200C9A66",
299300
},
301+
"destroy": false,
300302
"diff": {
301303
"ami": {
302304
"computed": false,
@@ -543,6 +545,7 @@ _modules = {
543545
"volume_tags": {},
544546
"vpc_security_group_ids": "74D93920-ED26-11E3-AC10-0800200C9A66",
545547
},
548+
"destroy": false,
546549
"diff": {
547550
"ami": {
548551
"computed": false,
@@ -787,6 +790,7 @@ _modules = {
787790
"volume_tags": {},
788791
"vpc_security_group_ids": "74D93920-ED26-11E3-AC10-0800200C9A66",
789792
},
793+
"destroy": false,
790794
"diff": {
791795
"ami": {
792796
"computed": false,

‎governance/second-generation/aws/test/restrict-availability-zones/mock-tfplan-fail-0.12.sentinel

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ _modules = {
3232
"user_data": null,
3333
"user_data_base64": null,
3434
},
35+
"destroy": false,
3536
"diff": {
3637
"ami": {
3738
"computed": false,

‎governance/second-generation/aws/test/restrict-availability-zones/mock-tfplan-pass-0.11.sentinel

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ _modules = {
5353
"volume_tags": {},
5454
"vpc_security_group_ids": "74D93920-ED26-11E3-AC10-0800200C9A66",
5555
},
56+
"destroy": false,
5657
"diff": {
5758
"ami": {
5859
"computed": false,
@@ -297,6 +298,7 @@ _modules = {
297298
"volume_tags": {},
298299
"vpc_security_group_ids": "74D93920-ED26-11E3-AC10-0800200C9A66",
299300
},
301+
"destroy": false,
300302
"diff": {
301303
"ami": {
302304
"computed": false,
@@ -543,6 +545,7 @@ _modules = {
543545
"volume_tags": {},
544546
"vpc_security_group_ids": "74D93920-ED26-11E3-AC10-0800200C9A66",
545547
},
548+
"destroy": false,
546549
"diff": {
547550
"ami": {
548551
"computed": false,
@@ -787,6 +790,7 @@ _modules = {
787790
"volume_tags": {},
788791
"vpc_security_group_ids": "74D93920-ED26-11E3-AC10-0800200C9A66",
789792
},
793+
"destroy": false,
790794
"diff": {
791795
"ami": {
792796
"computed": false,

‎governance/second-generation/aws/test/restrict-availability-zones/mock-tfplan-pass-0.12.sentinel

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ _modules = {
3232
"user_data": null,
3333
"user_data_base64": null,
3434
},
35+
"destroy": false,
3536
"diff": {
3637
"ami": {
3738
"computed": false,

‎governance/second-generation/aws/test/restrict-db-instance-engines/mock-tfplan-fail-0.11.sentinel

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ _modules = {
5050
"username": "foo",
5151
"vpc_security_group_ids": "74D93920-ED26-11E3-AC10-0800200C9A66",
5252
},
53+
"destroy": false,
5354
"diff": {
5455
"address": {
5556
"computed": true,

‎governance/second-generation/aws/test/restrict-db-instance-engines/mock-tfplan-fail-0.12.sentinel

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ _modules = {
4242
"timeouts": null,
4343
"username": "foo",
4444
},
45+
"destroy": false,
4546
"diff": {
4647
"address": {
4748
"computed": true,

0 commit comments

Comments
 (0)