A collection of security and best practice tests for static code analysis of terraform templates using terraform_validate.

• GitHub Repo: https://github.com/cesar-rodriguez/terrascan
• Documentation: https://terrascan.readthedocs.io.
• Tutorial: https://www.cloudsecuritymusings.com/blog/using-terrascan-for-static-code-analysis-of-your-infrastructure-code-part-1
• Free software: GNU General Public License v3

Terrascan will perform tests on your terraform templates to ensure:

• Encryption

  • Server Side Encryption (SSE) enabled
  • Use of AWS Key Management Service (KMS) with Customer Managed Keys (CMK)
  • Use of SSL/TLS and proper configuration

• Security Groups

  • Provisioning SGs in EC2-classic
  • Ingress open to 0.0.0.0/0

• Public Exposure

  • Services with public exposure other than Gateways (NAT, VGW, IGW)

• Logging & Monitoring

  • Access logs enabled to resources that support it

Terrascan uses Python and depends on pyhcl and terraform-validate (a fork has been included as part of terrascan that supports terraform 0.12+). After installing python in your system you can follow these steps:

$ pip install terrascan

To run, execute terrascan.py as follows replacing with the location of your terraform templates:

$ terrascan --location tests/infrastructure/success --vars tests/infrastructure/vars.json

• Returns 0 if no failures or errors; 4 otherwise

  • helps with use in a delivery pipeline

• Parameters:

  -h, --help            show this help message and exit
  -l LOCATION, --location LOCATION
                        location of terraform templates to scan
  -v [VARS [VARS ...]], --vars [VARS [VARS ...]]
                        variables json or .tf file name
  -o OVERRIDES, --overrides OVERRIDES
                        override rules file name
  -r RESULTS, --results RESULTS
                        output results file name
  -d [DISPLAYRULES], --displayRules [DISPLAYRULES]
                        display the rules used
  -w [WARRANTY], --warranty [WARRANTY]
                        displays the warranty
  -g [GPL], --gpl [GPL]
                        displays license information
  -c CONFIG, --config CONFIG
                        logging configuration: error, warning, info, debug, or
                        none; default is error
  

• Override file example

1. The first attribute is the name of the rule to be overridden.
2. The second attribute is the name of the resource to be overridden.

3. The third atttribute is the RR or RAR number that waives the failure. This is required for high severity rules; can be an empty string for medium and low severity rules.

{
        "overrides": [
                [
                        "aws_s3_bucket_server_side_encryption_configuration",
                        "noEncryptionWaived",
                        "RR-1234"
                ],
                [
                        "aws_rds_cluster_encryption",
                        "rds_cluster_bad",
                        "RAR-98765"
                ]
        ]
}

• Example output:

  Logging level set to error.
  ................
  ----------------------------------------------------------------------
  Ran 16 tests in 0.015s
  
  OK
  
  Processed 19 files in C:\DEV\terraforms\backends\10-network-analytics
  
  
  Results (took 1.08 seconds):
  
  Failures: (2)
  [high] [aws_dynamodb_table.encryption.server_side_encryption.enabled] should be 'True'. Is: 'False' in module 10-network-analytics, file C:\DEV\terraforms\backends\10-network-analytics\main.tf
  [high] [aws_s3_bucket.noEncryption] should have property: 'server_side_encryption_configuration' in module 10-network-analytics, file C:\DEV\terraforms\backends\10-network-analytics\main.tf
  
  Errors: (0)
  

Terrascan can be used on pre-commit hooks to prevent accidental introduction of security weaknesses into your repository. This requires having pre-commit installed. An example configuration is provided in the comments of the here file in this repository.

Legend:

• ➖ = test needs to be implemented
• ✔️ = test implemented
• blank - N/A