diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 0000000..5444631 --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,32 @@ +repos: + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.5.0 + hooks: + - id: check-merge-conflict + - id: end-of-file-fixer + - id: trailing-whitespace + + + - repo: https://github.com/antonbabenko/pre-commit-terraform + rev: v1.86.0 + hooks: + - id: terraform_fmt + - id: terraform_docs + args: + - '--args=--sort-by required' + - id: terraform_tflint + args: + - '--args=--only=terraform_deprecated_interpolation' + - '--args=--only=terraform_deprecated_index' + - '--args=--only=terraform_unused_declarations' + - '--args=--only=terraform_comment_syntax' + - '--args=--only=terraform_documented_outputs' + - '--args=--only=terraform_documented_variables' + - '--args=--only=terraform_typed_variables' + - '--args=--only=terraform_module_pinned_source' + - '--args=--only=terraform_naming_convention' + - '--args=--only=terraform_required_version' + - '--args=--only=terraform_required_providers' + - '--args=--only=terraform_standard_module_structure' + - '--args=--only=terraform_workspace_remote' + - id: terrascan diff --git a/modules/services/agentless-scan/README.md b/modules/services/agentless-scan/README.md index d8a3a91..dffe844 100644 --- a/modules/services/agentless-scan/README.md +++ b/modules/services/agentless-scan/README.md @@ -7,9 +7,9 @@ This module will deploy required resources for Sysdig to be able to scan hosts o The following resources will be created on each instrumented project: -- For the **Resource Discovery**: Enable Sysdig to authenticate through a Workload Identity Pool (requires provider, +- For the **Resource Discovery**: Enable Sysdig to authenticate through a Workload Identity Pool (requires provider, service account, role, and related bindings) in order to be able to discover the VPC/Instance/Volumes -- For the **Host Data Extraction**: Enable Sysdig to create a disk copy on our SaaS platform, to be able to extract +- For the **Host Data Extraction**: Enable Sysdig to create a disk copy on our SaaS platform, to be able to extract the data required for security assessment. ![permission-diagram.png](permission-diagram.png) @@ -89,4 +89,4 @@ Module is maintained by [Sysdig](https://sysdig.com). ## License -Apache 2 Licensed. See LICENSE for full details. \ No newline at end of file +Apache 2 Licensed. See LICENSE for full details. diff --git a/modules/services/agentless-scan/data.tf b/modules/services/agentless-scan/data.tf index c2d738c..10117db 100644 --- a/modules/services/agentless-scan/data.tf +++ b/modules/services/agentless-scan/data.tf @@ -1,3 +1,3 @@ data "google_project" "project" { project_id = var.project_id -} \ No newline at end of file +} diff --git a/modules/services/agentless-scan/locals.tf b/modules/services/agentless-scan/locals.tf index 8a77ae2..26cac73 100644 --- a/modules/services/agentless-scan/locals.tf +++ b/modules/services/agentless-scan/locals.tf @@ -6,4 +6,4 @@ locals { resource "random_id" "suffix" { count = var.suffix == null ? 1 : 0 byte_length = 3 -} \ No newline at end of file +} diff --git a/modules/services/agentless-scan/outputs.tf b/modules/services/agentless-scan/outputs.tf index 43c7a8b..0732042 100644 --- a/modules/services/agentless-scan/outputs.tf +++ b/modules/services/agentless-scan/outputs.tf @@ -41,5 +41,5 @@ output "json_payload" { error_message = "Cannot provide both sysdig_backend or sysdig_account_id" } - description="Deprecated. JSON Payload to internally provision customer on Sysdig VM Host scan on Sysdig" + description = "Deprecated. JSON Payload to internally provision customer on Sysdig VM Host scan on Sysdig" } diff --git a/modules/services/agentless-scan/provider.tf b/modules/services/agentless-scan/provider.tf index 0994a61..cca3774 100644 --- a/modules/services/agentless-scan/provider.tf +++ b/modules/services/agentless-scan/provider.tf @@ -15,4 +15,4 @@ terraform { version = "~> 1.19.0" } } -} \ No newline at end of file +} diff --git a/modules/services/agentless-scan/sysdig_provider.tf b/modules/services/agentless-scan/sysdig_provider.tf index db913f1..8e4080d 100644 --- a/modules/services/agentless-scan/sysdig_provider.tf +++ b/modules/services/agentless-scan/sysdig_provider.tf @@ -18,10 +18,10 @@ resource "sysdig_secure_cloud_auth_account" "gcp_project_" { # - module output values # - sysdig_provider outputs for API gcp = { - authUri = var.sysdig_backend != null ? google_iam_workload_identity_pool_provider.agentless[0].name : var.sysdig_account_id != null ? google_iam_workload_identity_pool_provider.agentless_gcp[0].name : null + authUri = var.sysdig_backend != null ? google_iam_workload_identity_pool_provider.agentless[0].name : var.sysdig_account_id != null ? google_iam_workload_identity_pool_provider.agentless_gcp[0].name : null clientEmail = google_service_account.controller.email } }) } - depends_on = [google_service_account.controller, var.sysdig_backend != null ? google_iam_workload_identity_pool_provider.agentless:google_iam_workload_identity_pool_provider.agentless_gcp] -} \ No newline at end of file + depends_on = [google_service_account.controller, var.sysdig_backend != null ? google_iam_workload_identity_pool_provider.agentless : google_iam_workload_identity_pool_provider.agentless_gcp] +} diff --git a/modules/services/agentless-scan/variables.tf b/modules/services/agentless-scan/variables.tf index 7485be6..ae304b6 100644 --- a/modules/services/agentless-scan/variables.tf +++ b/modules/services/agentless-scan/variables.tf @@ -34,4 +34,4 @@ variable "suffix" { type = string description = "By default a random value will be autogenerated.
Suffix word to enable multiple deployments with different naming
(Workload Identity Pool and Providers have a soft deletion on Google Platform that will disallow name re-utilization)" default = null -} \ No newline at end of file +} diff --git a/modules/services/agentless-scan/worker.tf b/modules/services/agentless-scan/worker.tf index c958b5d..50f9298 100644 --- a/modules/services/agentless-scan/worker.tf +++ b/modules/services/agentless-scan/worker.tf @@ -18,4 +18,4 @@ resource "google_project_iam_binding" "admin-account-iam" { members = [ "serviceAccount:${var.worker_identity}", ] -} \ No newline at end of file +}