feat: add Terraform plan evaluation and test framework - #214
Open
robmorgan wants to merge 9 commits into
Open
Conversation
Add internal/plan package for parsing Terraform plan JSON output with type-safe access and convenience methods. Includes: - Type definitions for Plan, ResourceChange, Change, StateValues - ParsePlanFile/ParsePlanBytes for parsing plan JSON - Query methods: ResourcesByType, ResourceByAddress, ResourcesByModule - Attribute access: GetAfter/GetBefore with nested path support - Typed helpers: GetAfterString, GetAfterBool, GetAfterInt, etc. - Action detection: IsCreate, IsUpdate, IsDelete, IsReplace, IsNoOp - Runner for terraform plan orchestration (RunPlan, PlanJSON, etc.) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add a new internal/rules package that provides a rule interface and registry for evaluating Terraform plan resources. This enables extensible rule-based validation of infrastructure changes. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Implement AWS-specific rules to detect security misconfigurations: Security Group rules (10 total): - aws-sg-no-public-ssh: Block SSH (port 22) from 0.0.0.0/0 - aws-sg-no-public-rdp: Block RDP (port 3389) from 0.0.0.0/0 - aws-sg-no-public-mysql: Block MySQL (port 3306) from 0.0.0.0/0 - aws-sg-no-public-postgres: Block PostgreSQL (port 5432) from 0.0.0.0/0 - aws-sg-no-unrestricted-ingress: Block protocol -1 from 0.0.0.0/0 - Plus 5 variants for aws_security_group_rule resources S3 rules (4 total): - aws-s3-no-public-acl: Disallow public-read/public-read-write ACLs - aws-s3-encryption-enabled: Require server-side encryption - aws-s3-versioning-enabled: Recommend versioning for data protection - aws-s3-no-public-policy: Require block_public_policy = true IAM rules (4 total): - aws-iam-no-wildcard-action: Block Action:* with Resource:* - aws-iam-no-admin-policy-role: Block AdministratorAccess on roles - aws-iam-no-admin-policy-user: Block AdministratorAccess on users - aws-iam-no-user-inline-policy: Discourage inline policies on users RDS rules (3 total): - aws-rds-encryption-enabled: Require storage_encrypted = true - aws-rds-no-public-access: Require publicly_accessible = false - aws-rds-backup-enabled: Require backup_retention_period > 0 Also adds provider registration pattern to avoid import cycles. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Implements `infraspec check` to evaluate Terraform plans against security rules before applying changes. Supports colorized terminal output, JSON format, severity filtering, and rule ignore lists. - Add internal/check package with runner, formatters, and types - Add cmd/check.go with --plan, --dir, --severity, --ignore, --format flags - Exit code 1 on rule violations, 0 on success - Unit and integration tests included Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add a simpler, higher-level API for running terraform plans: - PlanOptions struct for simplified configuration (vars, timeout, etc.) - FindTerraformBinary() to check terraform availability - GeneratePlan() and GeneratePlanWithContext() that handle init detection, plan execution, JSON output, and parsing in a single call - Progress message in check command when generating plans Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Implement HCL-based test file format similar to terraform test, enabling declarative infrastructure test definitions with variables, runs, and assertions. Uses hashicorp/hcl/v2 for parsing with expression preservation for future evaluation. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Implement a CEL (Common Expression Language) based assertion engine that evaluates expressions from .infraspec.hcl test files against Terraform plan data. New internal/assert package includes: - EvalContext type to build evaluation context from Terraform plans - CEL environment with custom functions (contains, anytrue, alltrue, length) - Automatic HCL dot notation to CEL bracket notation conversion - Engine with Evaluate, EvaluateExpression, and EvaluateAll methods Also fixes extractExprSource in testfile parser to return actual expression text using byte offsets instead of range info. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
AWS API Coverage Summary
Total: 257 operations implemented across 9 services (45.7% average coverage) Generated by CloudMirror - updates automatically when |
Contributor
Pull Request Review: Terraform Plan Evaluation FrameworkThis PR introduces a comprehensive Terraform plan evaluation framework with excellent architecture and code quality. Strengths
Issues & RecommendationsHigh Priority
Medium Priority
Low Priority
Security Notes
Final Assessment⭐⭐⭐⭐ Strong implementation with minor improvements needed Recommendation: Approve with changes requested for input validation and context management. Great work! 🚀 |
|
This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 365 days. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR introduces the foundational infrastructure for InfraSpec's Terraform plan evaluation and testing capabilities:
internal/plan/): Parse Terraform plan JSON output with typed accessors for resource changes, outputs, and variablesinternal/rules/): Extensible rules engine for evaluating Terraform plans against security policiesinfraspec checkcommand for plan security evaluationinternal/testfile/): Parser for.infraspec.hcltest file formatinternal/assert/): CEL-based expression evaluation for test assertions with custom functions (contains, anytrue, alltrue, length)Test plan
make go-test-cover)make lint)infraspec checkcommand against sample Terraform plans🤖 Generated with Claude Code