Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix panic when security groups are on EC2-Classic #89

Merged
merged 2 commits into from
Apr 8, 2017
Merged

Fix panic when security groups are on EC2-Classic #89

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a443d29
Use AccountAttributes instead of Vpcs
wata727 Apr 8, 2017
fb68848
Fix panic when security groups are on EC2-Classic
wata727 Apr 8, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions config/aws.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,7 @@ type ResponseCache struct {
DescribeSecurityGroupsOutput *ec2.DescribeSecurityGroupsOutput
DescribeVpcsOutput *ec2.DescribeVpcsOutput
DescribeInstancesOutput *ec2.DescribeInstancesOutput
DescribeAccountAttributesOutput *ec2.DescribeAccountAttributesOutput
ListInstanceProfilesOutput *iam.ListInstanceProfilesOutput
DescribeDBSubnetGroupsOutput *rds.DescribeDBSubnetGroupsOutput
DescribeDBParameterGroupsOutput *rds.DescribeDBParameterGroupsOutput
Expand Down Expand Up @@ -163,6 +164,17 @@ func (c *AwsClient) DescribeInstances() (*ec2.DescribeInstancesOutput, error) {
return c.Cache.DescribeInstancesOutput, nil
}

func (c AwsClient) DescribeAccountAttributes() (*ec2.DescribeAccountAttributesOutput, error) {
if c.Cache.DescribeAccountAttributesOutput == nil {
resp, err := c.Ec2.DescribeAccountAttributes(&ec2.DescribeAccountAttributesInput{})
if err != nil {
return nil, err
}
c.Cache.DescribeAccountAttributesOutput = resp
}
return c.Cache.DescribeAccountAttributesOutput, nil
}

func (c *AwsClient) ListInstanceProfiles() (*iam.ListInstanceProfilesOutput, error) {
if c.Cache.ListInstanceProfilesOutput == nil {
resp, err := c.Iam.ListInstanceProfiles(&iam.ListInstanceProfilesInput{})
Expand Down
17 changes: 12 additions & 5 deletions detector/aws_security_group_duplicate_name.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,19 +34,26 @@ func (d *AwsSecurityGroupDuplicateDetector) PreProcess() {
d.Error = true
return
}
vpcsResp, err := d.AwsClient.DescribeVpcs()
attrsResp, err := d.AwsClient.DescribeAccountAttributes()
if err != nil {
d.Logger.Error(err)
d.Error = true
return
}

for _, securityGroup := range securityGroupsResp.SecurityGroups {
d.securiyGroups[*securityGroup.VpcId+"."+*securityGroup.GroupName] = true
var vpcId string
// If vpcId is nil, it is on EC2-Classic.
if securityGroup.VpcId == nil {
vpcId = "none"
} else {
vpcId = *securityGroup.VpcId
}
d.securiyGroups[vpcId+"."+*securityGroup.GroupName] = true
}
for _, vpcResource := range vpcsResp.Vpcs {
if *vpcResource.IsDefault {
d.defaultVpc = *vpcResource.VpcId
for _, attr := range attrsResp.AccountAttributes {
if *attr.AttributeName == "default-vpc" {
d.defaultVpc = *attr.AttributeValues[0].AttributeValue
break
}
}
Expand Down
212 changes: 160 additions & 52 deletions detector/aws_security_group_duplicate_name_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,12 @@ import (

func TestDetectAwsSecurityGroupDuplicateName(t *testing.T) {
cases := []struct {
Name string
Src string
State string
SecurityGroups []*ec2.SecurityGroup
Vpcs []*ec2.Vpc
Issues []*issue.Issue
Name string
Src string
State string
SecurityGroups []*ec2.SecurityGroup
AccountAttributes []*ec2.AccountAttribute
Issues []*issue.Issue
}{
{
Name: "security group name is duplicate",
Expand All @@ -30,23 +30,35 @@ resource "aws_security_group" "test" {
vpc_id = "vpc-1234abcd"
}`,
SecurityGroups: []*ec2.SecurityGroup{
&ec2.SecurityGroup{
{
GroupName: aws.String("default"),
VpcId: aws.String("vpc-1234abcd"),
},
&ec2.SecurityGroup{
{
GroupName: aws.String("custom"),
VpcId: aws.String("vpc-1234abcd"),
},
},
Vpcs: []*ec2.Vpc{
&ec2.Vpc{
VpcId: aws.String("vpc-1234abcd"),
IsDefault: aws.Bool(true),
AccountAttributes: []*ec2.AccountAttribute{
{
AttributeName: aws.String("supported-platforms"),
AttributeValues: []*ec2.AccountAttributeValue{
{
AttributeValue: aws.String("VPC"),
},
},
},
{
AttributeName: aws.String("default-vpc"),
AttributeValues: []*ec2.AccountAttributeValue{
{
AttributeValue: aws.String("vpc-1234abcd"),
},
},
},
},
Issues: []*issue.Issue{
&issue.Issue{
{
Type: "ERROR",
Message: "\"default\" is duplicate name. It must be unique.",
Line: 3,
Expand All @@ -62,19 +74,31 @@ resource "aws_security_group" "test" {
vpc_id = "vpc-1234abcd"
}`,
SecurityGroups: []*ec2.SecurityGroup{
&ec2.SecurityGroup{
{
GroupName: aws.String("default"),
VpcId: aws.String("vpc-1234abcd"),
},
&ec2.SecurityGroup{
{
GroupName: aws.String("custom"),
VpcId: aws.String("vpc-1234abcd"),
},
},
Vpcs: []*ec2.Vpc{
&ec2.Vpc{
VpcId: aws.String("vpc-1234abcd"),
IsDefault: aws.Bool(true),
AccountAttributes: []*ec2.AccountAttribute{
{
AttributeName: aws.String("supported-platforms"),
AttributeValues: []*ec2.AccountAttributeValue{
{
AttributeValue: aws.String("VPC"),
},
},
},
{
AttributeName: aws.String("default-vpc"),
AttributeValues: []*ec2.AccountAttributeValue{
{
AttributeValue: aws.String("vpc-1234abcd"),
},
},
},
},
Issues: []*issue.Issue{},
Expand All @@ -87,19 +111,31 @@ resource "aws_security_group" "test" {
vpc_id = "vpc-1234abcd"
}`,
SecurityGroups: []*ec2.SecurityGroup{
&ec2.SecurityGroup{
{
GroupName: aws.String("default"),
VpcId: aws.String("vpc-abcd1234"),
},
&ec2.SecurityGroup{
{
GroupName: aws.String("custom"),
VpcId: aws.String("vpc-abcd1234"),
},
},
Vpcs: []*ec2.Vpc{
&ec2.Vpc{
VpcId: aws.String("vpc-1234abcd"),
IsDefault: aws.Bool(true),
AccountAttributes: []*ec2.AccountAttribute{
{
AttributeName: aws.String("supported-platforms"),
AttributeValues: []*ec2.AccountAttributeValue{
{
AttributeValue: aws.String("VPC"),
},
},
},
{
AttributeName: aws.String("default-vpc"),
AttributeValues: []*ec2.AccountAttributeValue{
{
AttributeValue: aws.String("vpc-1234abcd"),
},
},
},
},
Issues: []*issue.Issue{},
Expand All @@ -111,23 +147,31 @@ resource "aws_security_group" "test" {
name = "default"
}`,
SecurityGroups: []*ec2.SecurityGroup{
&ec2.SecurityGroup{
{
GroupName: aws.String("default"),
VpcId: aws.String("vpc-1234abcd"),
},
&ec2.SecurityGroup{
{
GroupName: aws.String("custom"),
VpcId: aws.String("vpc-1234abcd"),
},
},
Vpcs: []*ec2.Vpc{
&ec2.Vpc{
VpcId: aws.String("vpc-1234abcd"),
IsDefault: aws.Bool(false),
AccountAttributes: []*ec2.AccountAttribute{
{
AttributeName: aws.String("supported-platforms"),
AttributeValues: []*ec2.AccountAttributeValue{
{
AttributeValue: aws.String("VPC"),
},
},
},
&ec2.Vpc{
VpcId: aws.String("vpc-abcd1234"),
IsDefault: aws.Bool(true),
{
AttributeName: aws.String("default-vpc"),
AttributeValues: []*ec2.AccountAttributeValue{
{
AttributeValue: aws.String("vpc-abcd1234"),
},
},
},
},
Issues: []*issue.Issue{},
Expand All @@ -139,27 +183,35 @@ resource "aws_security_group" "test" {
name = "default"
}`,
SecurityGroups: []*ec2.SecurityGroup{
&ec2.SecurityGroup{
{
GroupName: aws.String("default"),
VpcId: aws.String("vpc-1234abcd"),
},
&ec2.SecurityGroup{
{
GroupName: aws.String("custom"),
VpcId: aws.String("vpc-1234abcd"),
},
},
Vpcs: []*ec2.Vpc{
&ec2.Vpc{
VpcId: aws.String("vpc-1234abcd"),
IsDefault: aws.Bool(true),
AccountAttributes: []*ec2.AccountAttribute{
{
AttributeName: aws.String("supported-platforms"),
AttributeValues: []*ec2.AccountAttributeValue{
{
AttributeValue: aws.String("VPC"),
},
},
},
&ec2.Vpc{
VpcId: aws.String("vpc-abcd1234"),
IsDefault: aws.Bool(false),
{
AttributeName: aws.String("default-vpc"),
AttributeValues: []*ec2.AccountAttributeValue{
{
AttributeValue: aws.String("vpc-1234abcd"),
},
},
},
},
Issues: []*issue.Issue{
&issue.Issue{
{
Type: "ERROR",
Message: "\"default\" is duplicate name. It must be unique.",
Line: 3,
Expand Down Expand Up @@ -198,23 +250,79 @@ resource "aws_security_group" "test" {
}
`,
SecurityGroups: []*ec2.SecurityGroup{
&ec2.SecurityGroup{
{
GroupName: aws.String("default"),
VpcId: aws.String("vpc-1234abcd"),
},
&ec2.SecurityGroup{
{
GroupName: aws.String("custom"),
VpcId: aws.String("vpc-1234abcd"),
},
},
Vpcs: []*ec2.Vpc{
&ec2.Vpc{
VpcId: aws.String("vpc-1234abcd"),
IsDefault: aws.Bool(true),
AccountAttributes: []*ec2.AccountAttribute{
{
AttributeName: aws.String("supported-platforms"),
AttributeValues: []*ec2.AccountAttributeValue{
{
AttributeValue: aws.String("VPC"),
},
},
},
{
AttributeName: aws.String("default-vpc"),
AttributeValues: []*ec2.AccountAttributeValue{
{
AttributeValue: aws.String("vpc-1234abcd"),
},
},
},
},
Issues: []*issue.Issue{},
},
{
Name: "security group name is duplicate when omitted vpc_id on EC2-Classic",
Src: `
resource "aws_security_group" "test" {
name = "default"
}`,
SecurityGroups: []*ec2.SecurityGroup{
{
GroupName: aws.String("default"),
},
{
GroupName: aws.String("custom"),
},
},
AccountAttributes: []*ec2.AccountAttribute{
{
AttributeName: aws.String("supported-platforms"),
AttributeValues: []*ec2.AccountAttributeValue{
{
AttributeValue: aws.String("EC2"),
},
{
AttributeValue: aws.String("VPC"),
},
},
},
{
AttributeName: aws.String("default-vpc"),
AttributeValues: []*ec2.AccountAttributeValue{
{
AttributeValue: aws.String("none"),
},
},
},
},
Issues: []*issue.Issue{
{
Type: "ERROR",
Message: "\"default\" is duplicate name. It must be unique.",
Line: 3,
File: "test.tf",
},
},
},
}

for _, tc := range cases {
Expand All @@ -228,8 +336,8 @@ resource "aws_security_group" "test" {
ec2mock.EXPECT().DescribeSecurityGroups(&ec2.DescribeSecurityGroupsInput{}).Return(&ec2.DescribeSecurityGroupsOutput{
SecurityGroups: tc.SecurityGroups,
}, nil)
ec2mock.EXPECT().DescribeVpcs(&ec2.DescribeVpcsInput{}).Return(&ec2.DescribeVpcsOutput{
Vpcs: tc.Vpcs,
ec2mock.EXPECT().DescribeAccountAttributes(&ec2.DescribeAccountAttributesInput{}).Return(&ec2.DescribeAccountAttributesOutput{
AccountAttributes: tc.AccountAttributes,
}, nil)
awsClient.Ec2 = ec2mock

Expand Down