Repository navigation
feat: grant wafv2:Get*, ec2:GetEbsEncryptionByDefault and the missing… #100
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Terraform validate | |
| # Lints and validates the customer-facing Terraform modules so a regression | |
| # in gcp-integration-setup, aws-integration-setup, or azure-integration-setup | |
| # gets caught in CI rather than at customer apply time. The historical incident | |
| # this is meant to prevent: a project-scoped custom role bound at the org level | |
| # (#40) that only blew up when a customer ran terraform apply. | |
| on: | |
| pull_request: | |
| paths: | |
| - "gcp-integration-setup/**" | |
| - "aws-integration-setup/**" | |
| - "azure-integration-setup/**" | |
| - "scripts/check_iam_policy_drift.py" | |
| - ".github/workflows/terraform-validate.yml" | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - "gcp-integration-setup/**" | |
| - "aws-integration-setup/**" | |
| - "azure-integration-setup/**" | |
| - "scripts/check_iam_policy_drift.py" | |
| - ".github/workflows/terraform-validate.yml" | |
| permissions: | |
| contents: read | |
| jobs: | |
| terraform: | |
| name: terraform (${{ matrix.directory }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - directory: gcp-integration-setup/terraform | |
| terraform: 1.9.5 | |
| - directory: gcp-integration-setup/terraform/examples/organization | |
| terraform: 1.9.5 | |
| - directory: gcp-integration-setup/terraform/examples/folder | |
| terraform: 1.9.5 | |
| - directory: gcp-integration-setup/terraform/examples/single-project | |
| terraform: 1.9.5 | |
| - directory: aws-integration-setup/terraform | |
| terraform: 1.9.5 | |
| - directory: aws-integration-setup/terraform/examples/basic | |
| terraform: 1.9.5 | |
| - directory: aws-integration-setup/terraform/examples/multi-cluster-complete | |
| terraform: 1.9.5 | |
| - directory: aws-integration-setup/terraform-v6 | |
| terraform: 1.9.5 | |
| - directory: aws-integration-setup/terraform-v6/examples/basic | |
| terraform: 1.9.5 | |
| - directory: aws-integration-setup/terraform-v6/examples/multi-cluster-complete | |
| terraform: 1.10.5 | |
| - directory: azure-integration-setup/terraform | |
| terraform: 1.9.5 | |
| - directory: azure-integration-setup/terraform/examples/management-group | |
| terraform: 1.9.5 | |
| - directory: azure-integration-setup/terraform/examples/subscriptions | |
| terraform: 1.9.5 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: hashicorp/setup-terraform@v3 | |
| with: | |
| terraform_version: ${{ matrix.terraform }} | |
| terraform_wrapper: false | |
| - name: terraform fmt -check | |
| working-directory: ${{ matrix.directory }} | |
| run: terraform fmt -check -recursive | |
| - name: terraform init -backend=false | |
| working-directory: ${{ matrix.directory }} | |
| run: terraform init -backend=false | |
| - name: terraform validate | |
| working-directory: ${{ matrix.directory }} | |
| run: terraform validate | |
| # The CloudFormation template and both Terraform trees grant the same | |
| # customer role from three independently maintained templates (ncc #58, | |
| # whiskeylotus W58-3). This job parses the CFN JSON and fails if any | |
| # Allow/Deny statement set drifts. | |
| iam-policy-drift: | |
| name: IAM policy drift (CloudFormation vs Terraform) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: parse CloudFormation template | |
| run: python3 -m json.tool aws-integration-setup/cloudformation/nullify-cloudformation-template.json > /dev/null | |
| - name: compare Allow/Deny action sets | |
| run: python3 scripts/check_iam_policy_drift.py | |
| shellcheck: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: shellcheck install + run | |
| run: | | |
| sudo apt-get update -y >/dev/null | |
| sudo apt-get install -y shellcheck >/dev/null | |
| shellcheck gcp-integration-setup/scripts/install.sh | |
| shellcheck gcp-integration-setup/scripts/uninstall.sh |