Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Question: Can this run from kitchen-terraform #44

Closed
brettcurtis opened this issue Aug 5, 2020 · 25 comments
Closed

Question: Can this run from kitchen-terraform #44

brettcurtis opened this issue Aug 5, 2020 · 25 comments

Comments

@brettcurtis
Copy link

First all this repo has help me A LOT so thanks for putting in the work! I'm able to hit gcp at a project level and understand exactly what I need to do to address benchmark violations. I'm also able to include it as a test in our infra CD pipelines.

What I'm trying to do is run this from kitchen-terraform in an effort to reduce the feedback loop for infrastructure developers. I'm new to inspec and kitchen so I hope I'm just not understanding what to do here. That being said I've removed the kitchen part out of it and am trying to just get it working using inspec the way kitchen-terraform would "consume it" I guess you could say.

bash$ tree default-vpc
default-vpc
├── controls
│   └── gcp-cis-benchmark.rb
└── inspec.yml

inspec.yaml:

name: default-vpc
supports:
  - platform: gcp
depends:
  - name: inspec-gcp-cis-benchmark
    url: https://github.com/GoogleCloudPlatform/inspec-gcp-cis-benchmark/archive/v1.1.0-11.tar.gz

gcp-cis-benchmark.rb:

require_controls 'inspec-gcp-cis-benchmark' do
  control 'cis-gcp-3.6-networking'
  control 'cis-gcp-3.7-networking'
end

When I run inspec check default-vpc

!  inspec-gcp-cis-benchmark-1.1.0-11/controls/3.06-networking.rb:23: Control cis-gcp-3.6-networking has no tests defined
!  inspec-gcp-cis-benchmark-1.1.0-11/controls/3.07-networking.rb:23: Control cis-gcp-3.7-networking has no tests defined

Appreciate any guidance on this one!
@binamov
Copy link
Member

binamov commented Aug 5, 2020

@brettcurtis are you specifying the target of GCP by doing inspec check default-vpc -t gcp:// ?

@binamov
Copy link
Member

binamov commented Aug 5, 2020

And yes, this works with kitchen-terraform very nicely.

@brettcurtis
Copy link
Author

Looks like -t isn't an option for check ?

@binamov
Copy link
Member

binamov commented Aug 5, 2020

yeah i meant -t for inspec exec

@brettcurtis
Copy link
Author

brettcurtis commented Aug 5, 2020 •
edited

ok yeah I did try that initially but tests didn't run so I went to the "check" to try and figure out what was going on form there. It's pulling the profiles just not running the tests:

 bundle exec inspec exec default-vpc -t gcp://

Profile: default-vpc
Version: (not specified)
Target:  gcp://764086051850-6qr4p6gpi6hn506pt8ejuq83di341hur.apps.googleusercontent.com

     No tests executed.

Profile: Inspec GCP CIS 1.1 Benchmark (inspec-gcp-cis-benchmark)
Version: 1.1.0-11
Target:  gcp://764086051850-6qr4p6gpi6hn506pt8ejuq83di341hur.apps.googleusercontent.com

     No tests executed.

Profile: GCP CIS PCI Helper Resource Pack (inspec-gcp-helpers)
Version: 1.0.7
Target:  gcp://764086051850-6qr4p6gpi6hn506pt8ejuq83di341hur.apps.googleusercontent.com

     No tests executed.

Profile: Google Cloud Platform Resource Pack (inspec-gcp)
Version: 1.7.0
Target:  gcp://764086051850-6qr4p6gpi6hn506pt8ejuq83di341hur.apps.googleusercontent.com

     No tests executed.

Test Summary: 0 successful, 0 failures, 0 skipped

@brettcurtis
Copy link
Author

bah ok this works:
bundle exec inspec exec default-vpc -t gcp:// --input gcp_project_id=my-project-id

So i guess it's just ignoring tests if i don't pass that. So I need to pass my terraform "output" of project_id to a variable of gcp_project_id somehow?

I removed all that since i was trying to figure out how it worked and was hoping i would see an error around the missing gcp_project_id but I didn't so figured my problem was elsewhere.

@brettcurtis
Copy link
Author

Let me see if I can ask my question a bit better now that I'm starting to understand this a tiny bit more.

How can I pass my terraform output of project_id to your tests that require an input of gcp_project_id ?

@binamov
Copy link
Member

binamov commented Aug 5, 2020

There's a few ways @brettcurtis . Your inspec.yml may have something like foo : <%= ENV['bar'] %> to read the value from an env var.
You could render the project id to eg an inspec.yml file from the terraform run itself. If using test-kitchen then kitchen yml attributes. You have choices :)

@brettcurtis
Copy link
Author

Would you expect this to work, I'm just trying to understand the inputs:

input('gcp_project_id', value: 'my-tf-module-testing')
control 'attr' do
  title 'Terraform Outputs'
  desc 'Terraform Outputs'

  describe input('gcp_project_id') do
    it { should eq 'my-tf-module-testing' }
  end
end

require_controls 'inspec-gcp-cis-benchmark' do
  control 'cis-gcp-3.6-networking'
  control 'cis-gcp-3.7-networking'
end

Running: bundle exec inspec exec default-vpc -t gcp://

My attr control runs fine however not the cis controls. They will only run if I pass the input from the command line:
bundle exec inspec exec default-vpc -t gcp:// --input gcp_project_id=my-tf-module-testing

@KonradSchieban
Copy link
Collaborator

@brettcurtis We have previously worked on an automation pipeline for terraform with InSpec compliance validation. Maybe this implementation for the pci on gke blueprint could be interesting for you: https://github.com/GoogleCloudPlatform/pci-gke-blueprint/blob/master/cicd/cloudbuild.yml

@brettcurtis
Copy link
Author

thanks I'll take a look @KonradSchieban. Right now I'm just struggling with the tests running when I try to exclude the --input argument from the command line and add it directly to the profile’s control code. I've read this a few times and have tests case that work with inputs but I suspect they need to be handled differently with require_controls - i think I've tried putting the input about everywhere at this point.

My initial question was answered and I guess my question now is just more inspec related so if there are no more suggestions feel free to close this out.

@binamov
Copy link
Member

binamov commented Aug 6, 2020

This docpage should help @brettcurtis https://docs.chef.io/inspec/inputs/#how-can-i-set-inputs

@brettcurtis
Copy link
Author

Yeah, I must still be missing something because I would expect this to work:

input('gcp_project_id', value: 'my-tf-module-testing')
# this control passes
control 'attr' do
  title 'Terraform Outputs'
  desc 'Terraform Outputs'

  describe input('gcp_project_id') do
    it { should eq 'my-tf-module-testing' }
  end
end

require_controls 'inspec-gcp-cis-benchmark' do
# this control fails with the below error.
  control 'bla' do
    describe input('gcp_project_id') do
      it { should eq 'my-tf-module-testing' }
    end
  end
  control 'cis-gcp-3.6-networking' 
  control 'cis-gcp-3.7-networking'
end

Error:


Profile: Inspec GCP CIS 1.1 Benchmark (inspec-gcp-cis-benchmark)
Version: 1.1.0-11
Target:  gcp://764086051850-6qr4p6gpi6hn506pt8ejuq83di341hur.apps.googleusercontent.com

  ×  bla: replace_with_your_gcp_project_id
     ×  replace_with_your_gcp_project_id is expected to eq "my-tf-module-testing"
     
     expected: "my-tf-module-testing"
          got: "replace_with_your_gcp_project_id"
     
     (compared using ==)

@brettcurtis
Copy link
Author

sooo, learning out loud here.. :)

The only place I can get the input to override so far is in my insepc.yml like this part of the documentation talks about: https://docs.chef.io/inspec/inputs/#using-inputs-with-profile-inheritance

inspec.yml

name: default-vpc
supports:
  - platform: gcp
depends:
  - name: inspec-gcp
    url: https://github.com/inspec/inspec-gcp/archive/v1.7.0.tar.gz
  - name: inspec-gcp-cis-benchmark
    url: https://github.com/GoogleCloudPlatform/inspec-gcp-cis-benchmark/archive/v1.1.0-11.tar.gz
inputs:
  - name: gcp_project_id
    value: my-tf-module-testing
    profile: inspec-gcp-cis-benchmark

So if that's the only way it will work I'd need to understand if my terrafrom output for the project id can be used here somehow..

@binamov
Copy link
Member

binamov commented Aug 6, 2020

something like this can work

in your wrapper inspec.yml

inputs:
- name: gcp_project_id
  value : <%= ENV['gcp_project_id'] %>

and then after the tf run in your shell, before running inspec

$ export gcp_project_id=$(terraform output whatever-the-tf-gcp-project-id-output-is)

@aaronlippold
Copy link
Contributor

aaronlippold commented Aug 6, 2020 via email

@brettcurtis
Copy link
Author

thanks @binamov - yeah @aaronlippold that's what I'm using (removed it from the mix for troubleshooting the inputs) so I'm guessing there is a way to use my outputs in my inspec.yml.

@binamov
Copy link
Member

binamov commented Aug 7, 2020

with kt, tf outputs should be automatically exposed as inspec inputs

@brettcurtis
Copy link
Author

Right, I did read that. I'm just trying to figure out if I can keep my output name of project_id somehow when you guys are expecting gcp_project_id. I'm messing around now to see if I can understand how the outputs work with kt. Thanks for all the help.

@brettcurtis
Copy link
Author

If I add an additional output for gcp_project_id and include the following in my inspec.yml:

inputs:
  - name: gcp_project_id
    profile: inspec-gcp-cis-benchmark

Everything works through kt. Not the most elegant solution for me since I have project_id as an output already but good enough for now !

@binamov
Copy link
Member

binamov commented Aug 7, 2020

Everything works through kt. Not the most elegant solution for me since I have project_id as an output already but good enough for now !

you should be able to use KT verifier's attrs_outputs for this https://www.rubydoc.info/github/newcontext-oss/kitchen-terraform/Kitchen/Verifier/Terraform

@brettcurtis
Copy link
Author

Perfect! I've got this all working exactly how I want now! We are doing terraform module development and this is perfect to run with kitchen-terrafrom to get fast security feedback related only to the specific resources in that given module. Then in our root modules pipelines our teams consume to build their application infra we run the full suite of CIS tests as describe in your readme. I'll probably write a howto somewhere since I think this all is a bit tricky to put together for someone with a non-developer background. This is great, learned a ton working through this and thanks again for all the guidance!!

@aaronlippold
Copy link
Contributor

aaronlippold commented Aug 7, 2020 via email

@brettcurtis
Copy link
Author

Howdy @aaronlippold - I started this series of post here:
https://dev.to/brettcurtis/series/8673

This is all still very new to me so any suggested edits or things you think would be helpful to others to see let me know and I can add it! The next post will focus more on Github and development practices moving forward, possibly a bit around some struggles we still have as well.

@aaronlippold
Copy link
Contributor

aaronlippold commented Sep 6, 2020 via email

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@binamov @aaronlippold @brettcurtis @KonradSchieban