BAH - 1566 | Added. terrascan to pre-commit hook

.pre-commit-config.yaml

@@ -3,3 +3,9 @@ repos:
   rev: v0.1.17
   hooks:
     - id: terraform-fmt
+- repo: local
+  hooks:
+    - id: terrascan
+      name: Terrascan
+      language: script
+      entry : ./terrascan/terrascan.sh

README.md

@@ -18,7 +18,11 @@ This is a one-time setup that needs to be run only when the repo is cloned.
         pip install pre-commit 
         (or)
         brew install pre-commit
-2. Initialise pre-commit hooks
+2. Install pre-commit dependencies
+
+      - [terrascan](https://github.com/accurics/terrascan)
+
+3. Initialise pre-commit hooks
 
         pre-commit install --install-hooks
 

terraform/modules/rds/security_group.tf

@@ -8,7 +8,7 @@ resource "aws_security_group" "rds" {
     from_port   = var.mysql_rds_port
     to_port     = var.mysql_rds_port
     protocol    = "tcp"
-    cidr_blocks = ["0.0.0.0/0"]
+    cidr_blocks = [data.aws_vpc.bahmni-vpc.cidr_block]
   }
   tags = {
     Name = "bahmni-rds-sg-${var.environment}"

terrascan/terrascan-config.yaml

@@ -0,0 +1,3 @@
+rules:
+  skip-rules:
+    - AC_AWS_0480   # Skips validation of detailed monitoring for EC2 Instances

terrascan/terrascan.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+
+# Terrascan scan and save output to scan_results
+scan_results="$(terrascan scan --config-path terrascan/terrascan-config.yaml --iac-type terraform --use-colors t)"
+
+# Get scan summary from scan_results
+scan_summary=$(echo "$scan_results" | sed -n -e '/Scan Summary -/,$p' | sed -r "s/[[:cntrl:]]\[([0-9]{1,3};)*[0-9]{1,3}m//g")
+
+#Extract values from scan_summary
+low_level_violations=$(grep "Low" <<< "$scan_summary" | grep -o -E "[0-9]+")
+medium_level_violations=$(grep "Medium" <<< "$scan_summary" | grep -o -E "[0-9]+")
+high_level_violations=$(grep "High" <<< "$scan_summary" | grep -o -E "[0-9]+") 
+
+#Show Scan Output
+echo "$scan_results"
+
+#Check for violations
+if [[ $high_level_violations -gt 0 ]]
+then
+    echo "High Level Voilations Found"
+    exit 1
+fi
+echo "No Violations found"
+exit 0