add invalid security group detector for ELB

detector/aws_elb_invalid_security_group.go

@@ -0,0 +1,63 @@
+package detector
+
+import (
+	"fmt"
+
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/wata727/tflint/issue"
+)
+
+type AwsELBInvalidSecurityGroupDetector struct {
+	*Detector
+}
+
+func (d *Detector) CreateAwsELBInvalidSecurityGroupDetector() *AwsELBInvalidSecurityGroupDetector {
+	return &AwsELBInvalidSecurityGroupDetector{d}
+}
+
+func (d *AwsELBInvalidSecurityGroupDetector) Detect(issues *[]*issue.Issue) {
+	if !d.isDeepCheck("resource", "aws_elb") {
+		return
+	}
+
+	validSecurityGroups := map[string]bool{}
+	if d.ResponseCache.DescribeSecurityGroupsOutput == nil {
+		resp, err := d.AwsClient.Ec2.DescribeSecurityGroups(&ec2.DescribeSecurityGroupsInput{})
+		if err != nil {
+			d.Logger.Error(err)
+			d.Error = true
+		}
+		d.ResponseCache.DescribeSecurityGroupsOutput = resp
+	}
+	for _, securityGroup := range d.ResponseCache.DescribeSecurityGroupsOutput.SecurityGroups {
+		validSecurityGroups[*securityGroup.GroupId] = true
+	}
+
+	for filename, list := range d.ListMap {
+		for _, item := range list.Filter("resource", "aws_elb").Items {
+			securityGroupTokens, err := hclLiteralListToken(item, "security_groups")
+			if err != nil {
+				d.Logger.Error(err)
+				continue
+			}
+
+			for _, securityGroupToken := range securityGroupTokens {
+				securityGroup, err := d.evalToString(securityGroupToken.Text)
+				if err != nil {
+					d.Logger.Error(err)
+					continue
+				}
+
+				if !validSecurityGroups[securityGroup] {
+					issue := &issue.Issue{
+						Type:    "ERROR",
+						Message: fmt.Sprintf("\"%s\" is invalid security group.", securityGroup),
+						Line:    securityGroupToken.Pos.Line,
+						File:    filename,
+					}
+					*issues = append(*issues, issue)
+				}
+			}
+		}
+	}
+}

detector/aws_elb_invalid_security_group_test.go

@@ -0,0 +1,101 @@
+package detector
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/golang/mock/gomock"
+	"github.com/wata727/tflint/awsmock"
+	"github.com/wata727/tflint/config"
+	"github.com/wata727/tflint/issue"
+)
+
+func TestDetectAwsELBInvalidSecurityGroup(t *testing.T) {
+	cases := []struct {
+		Name     string
+		Src      string
+		Response []*ec2.SecurityGroup
+		Issues   []*issue.Issue
+	}{
+		{
+			Name: "security group is invalid",
+			Src: `
+resource "aws_elb" "balancer" {
+    security_groups = [
+        "sg-1234abcd",
+        "sg-abcd1234",
+    ]
+}`,
+			Response: []*ec2.SecurityGroup{
+				&ec2.SecurityGroup{
+					GroupId: aws.String("sg-12345678"),
+				},
+				&ec2.SecurityGroup{
+					GroupId: aws.String("sg-abcdefgh"),
+				},
+			},
+			Issues: []*issue.Issue{
+				&issue.Issue{
+					Type:    "ERROR",
+					Message: "\"sg-1234abcd\" is invalid security group.",
+					Line:    4,
+					File:    "test.tf",
+				},
+				&issue.Issue{
+					Type:    "ERROR",
+					Message: "\"sg-abcd1234\" is invalid security group.",
+					Line:    5,
+					File:    "test.tf",
+				},
+			},
+		},
+		{
+			Name: "security group is valid",
+			Src: `
+resource "aws_elb" "balancer" {
+    security_groups = [
+        "sg-1234abcd",
+        "sg-abcd1234",
+    ]
+}`,
+			Response: []*ec2.SecurityGroup{
+				&ec2.SecurityGroup{
+					GroupId: aws.String("sg-1234abcd"),
+				},
+				&ec2.SecurityGroup{
+					GroupId: aws.String("sg-abcd1234"),
+				},
+			},
+			Issues: []*issue.Issue{},
+		},
+	}
+
+	for _, tc := range cases {
+		c := config.Init()
+		c.DeepCheck = true
+
+		awsClient := c.NewAwsClient()
+		ctrl := gomock.NewController(t)
+		defer ctrl.Finish()
+		ec2mock := awsmock.NewMockEC2API(ctrl)
+		ec2mock.EXPECT().DescribeSecurityGroups(&ec2.DescribeSecurityGroupsInput{}).Return(&ec2.DescribeSecurityGroupsOutput{
+			SecurityGroups: tc.Response,
+		}, nil)
+		awsClient.Ec2 = ec2mock
+
+		var issues = []*issue.Issue{}
+		TestDetectByCreatorName(
+			"CreateAwsELBInvalidSecurityGroupDetector",
+			tc.Src,
+			c,
+			awsClient,
+			&issues,
+		)
+
+		if !reflect.DeepEqual(issues, tc.Issues) {
+			t.Fatalf("Bad: %s\nExpected: %s\n\ntestcase: %s", issues, tc.Issues, tc.Name)
+		}
+	}
+}

detector/detector.go

@@ -35,6 +35,7 @@ var detectors = map[string]string{
 	"aws_instance_invalid_key_name":                   "CreateAwsInstanceInvalidKeyNameDetector",
 	"aws_instance_invalid_subnet":                     "CreateAwsInstanceInvalidSubnetDetector",
 	"aws_instance_invalid_vpc_security_group":         "CreateAwsInstanceInvalidVPCSecurityGroupDetector",
+	"aws_elb_invalid_security_group":                  "CreateAwsELBInvalidSecurityGroupDetector",
 }
 
 func NewDetector(listMap map[string]*ast.ObjectList, c *config.Config) (*Detector, error) {

docs/AWS_ELB_Invalid_Security_Group.md

@@ -0,0 +1,41 @@
+# AWS ELB Invalid Security Group
+Report this issue if you have specified the invalid security group ID in VPC. This issue type is ERROR. This issue is enable only with deep check.
+
+## Example
+```
+resource "aws_elb" "balancer" {
+  name = "foobar-terraform-elb"
+  security_groups = [
+    "sg-12345678" # This security group ID does not exists
+  ]
+
+  access_logs {
+    bucket = "foo"
+    bucket_prefix = "bar"
+    interval = 60
+  }
+
+  listener {
+    instance_port = 8000
+    instance_protocol = "http"
+    lb_port = 80
+    lb_protocol = "http"
+  }
+}
+```
+
+The following is the execution result of TFLint: 
+
+```
+$ tflint --deep
+template.tf
+        ERROR:4 "sg-12345678" is invalid security group.
+
+Result: 1 issues  (1 errors , 0 warnings , 0 notices)
+```
+
+## Why
+If an invalid security group is specified, an error will occur at `terraform apply`.
+
+## How to fix
+Check your security groups and select a valid security group ID again.

docs/README.md

@@ -21,6 +21,8 @@ Issues are classified into the following three types.
     - [Invalid Key Name](AWS_Instance_Invalid_Key_Name.md)
     - [Invalid Subnet](AWS_Instance_Invalid_Subnet.md)
     - [Invalid VPC Security Group](AWS_Instance_Invalid_VPC_Security_Group.md)
+- AWS ELB
+    - [Invalid Security Group](AWS_ELB_Invalid_Security_Group.md)
 - AWS DB Instance
     - [Default Parameter Group](AWS_DB_Instance_Default_Parameter_Group.md)
 - AWS Elasticache Cluster