Skip to content

Commit 0b01bc5

Browse files
committed
refactor(rule): changed the name to make more sense
Signed-off-by: Fred Myerscough <oniice@gmail.com>
1 parent 6a7eb89 commit 0b01bc5

File tree

6 files changed

+57
-55
lines changed

6 files changed

+57
-55
lines changed

docs/rules.md

Lines changed: 41 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,46 @@
11
# Rule Details
22

3+
## aws_meta_hardcoded
4+
5+
This is a comprehensive rule that checks ALL AWS resources for hardcoded regions and partitions in ARN values. It works by walking through all expressions in your Terraform files and detecting any string that looks like an ARN with hardcoded values.
6+
7+
This rule covers resource types including:
8+
- Lambda (permissions, event source mappings, functions)
9+
- SNS/SQS (subscriptions, queue policies)
10+
- CloudWatch (event targets, log subscriptions, alarms)
11+
- API Gateway (integrations, authorizers)
12+
- KMS (grants, aliases, keys)
13+
- Secrets Manager (rotations, policies)
14+
- ECS (services, task definitions)
15+
- RDS (instances, event subscriptions, clusters)
16+
- S3 (notifications, policies, access points)
17+
- And many more...
18+
19+
**Example violations:**
20+
```hcl
21+
resource "aws_lambda_permission" "test" {
22+
source_arn = "arn:aws:s3:us-east-1:123456789012:bucket/my-bucket" # ❌ Hardcoded region and partition
23+
}
24+
25+
resource "aws_kms_grant" "test" {
26+
key_id = "arn:aws:kms:eu-west-1:123456789012:key/12345678-1234-1234-1234-123456789012" # ❌ Hardcoded region and partition
27+
}
28+
```
29+
30+
**Recommended fixes:**
31+
```hcl
32+
data "aws_region" "current" {}
33+
data "aws_partition" "current" {}
34+
35+
resource "aws_lambda_permission" "test" {
36+
source_arn = "arn:${data.aws_partition.current.partition}:s3:${data.aws_region.current.name}:123456789012:bucket/my-bucket" # ✅ Dynamic
37+
}
38+
39+
resource "aws_kms_grant" "test" {
40+
key_id = "arn:${data.aws_partition.current.partition}:kms:${data.aws_region.current.name}:123456789012:key/12345678-1234-1234-1234-123456789012" # ✅ Dynamic
41+
}
42+
```
43+
344
## aws_iam_role_policy_hardcoded_region
445

546
This rule checks `aws_iam_role_policy` resources for hardcoded AWS regions in policy documents. It examines both JSON policy strings and structured policy documents to detect:
@@ -151,43 +192,4 @@ provider "aws" {
151192
}
152193
```
153194

154-
## aws_arn_hardcoded
155-
156-
This is a comprehensive rule that checks ALL AWS resources for hardcoded regions and partitions in ARN values. It works by walking through all expressions in your Terraform files and detecting any string that looks like an ARN with hardcoded values.
157-
158-
This rule covers resource types including:
159-
- Lambda (permissions, event source mappings, functions)
160-
- SNS/SQS (subscriptions, queue policies)
161-
- CloudWatch (event targets, log subscriptions, alarms)
162-
- API Gateway (integrations, authorizers)
163-
- KMS (grants, aliases, keys)
164-
- Secrets Manager (rotations, policies)
165-
- ECS (services, task definitions)
166-
- RDS (instances, event subscriptions, clusters)
167-
- S3 (notifications, policies, access points)
168-
- And many more...
169195

170-
**Example violations:**
171-
```hcl
172-
resource "aws_lambda_permission" "test" {
173-
source_arn = "arn:aws:s3:us-east-1:123456789012:bucket/my-bucket" # ❌ Hardcoded region and partition
174-
}
175-
176-
resource "aws_kms_grant" "test" {
177-
key_id = "arn:aws:kms:eu-west-1:123456789012:key/12345678-1234-1234-1234-123456789012" # ❌ Hardcoded region and partition
178-
}
179-
```
180-
181-
**Recommended fixes:**
182-
```hcl
183-
data "aws_region" "current" {}
184-
data "aws_partition" "current" {}
185-
186-
resource "aws_lambda_permission" "test" {
187-
source_arn = "arn:${data.aws_partition.current.partition}:s3:${data.aws_region.current.name}:123456789012:bucket/my-bucket" # ✅ Dynamic
188-
}
189-
190-
resource "aws_kms_grant" "test" {
191-
key_id = "arn:${data.aws_partition.current.partition}:kms:${data.aws_region.current.name}:123456789012:key/12345678-1234-1234-1234-123456789012" # ✅ Dynamic
192-
}
193-
```

examples/failing/.tflint.hcl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,6 @@ rule "aws_provider_hardcoded_region" {
2222
enabled = true
2323
}
2424

25-
rule "aws_arn_hardcoded" {
25+
rule "aws_meta_hardcoded" {
2626
enabled = true
2727
}

examples/passing/.tflint.hcl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,6 @@ rule "aws_provider_hardcoded_region" {
2222
enabled = true
2323
}
2424

25-
rule "aws_arn_hardcoded" {
25+
rule "aws_meta_hardcoded" {
2626
enabled = true
2727
}

main.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,12 @@ func main() {
1212
Name: "aws-meta",
1313
Version: "0.1.0",
1414
Rules: []tflint.Rule{
15+
rules.NewAwsMetaHardcodedRule(),
1516
rules.NewAwsIamRolePolicyHardcodedRegionRule(),
1617
rules.NewAwsIamRolePolicyHardcodedPartitionRule(),
1718
rules.NewAwsIamPolicyHardcodedRegionRule(),
1819
rules.NewAwsIamPolicyHardcodedPartitionRule(),
1920
rules.NewAwsProviderHardcodedRegionRule(),
20-
rules.NewAwsARNHardcodedRule(),
2121
},
2222
},
2323
})

rules/aws_arn_hardcoded.go renamed to rules/aws_meta_hardcoded.go

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -9,39 +9,39 @@ import (
99
"github.com/terraform-linters/tflint-plugin-sdk/tflint"
1010
)
1111

12-
// AwsARNHardcodedRule checks for hardcoded regions and partitions in ARN values
12+
// AwsMetaHardcodedRule checks for hardcoded regions and partitions in ARN values
1313
// across all AWS resources by walking all expressions
14-
type AwsARNHardcodedRule struct {
14+
type AwsMetaHardcodedRule struct {
1515
tflint.DefaultRule
1616
}
1717

18-
// NewAwsARNHardcodedRule returns a new rule
19-
func NewAwsARNHardcodedRule() *AwsARNHardcodedRule {
20-
return &AwsARNHardcodedRule{}
18+
// NewAwsMetaHardcodedRule returns a new rule
19+
func NewAwsMetaHardcodedRule() *AwsMetaHardcodedRule {
20+
return &AwsMetaHardcodedRule{}
2121
}
2222

2323
// Name returns the rule name
24-
func (r *AwsARNHardcodedRule) Name() string {
25-
return "aws_arn_hardcoded"
24+
func (r *AwsMetaHardcodedRule) Name() string {
25+
return "aws_meta_hardcoded"
2626
}
2727

2828
// Enabled returns whether the rule is enabled by default
29-
func (r *AwsARNHardcodedRule) Enabled() bool {
29+
func (r *AwsMetaHardcodedRule) Enabled() bool {
3030
return true
3131
}
3232

3333
// Severity returns the rule severity
34-
func (r *AwsARNHardcodedRule) Severity() tflint.Severity {
34+
func (r *AwsMetaHardcodedRule) Severity() tflint.Severity {
3535
return tflint.WARNING
3636
}
3737

3838
// Link returns the rule reference link
39-
func (r *AwsARNHardcodedRule) Link() string {
39+
func (r *AwsMetaHardcodedRule) Link() string {
4040
return ""
4141
}
4242

4343
// Check checks for hardcoded regions and partitions in ARN-like string values
44-
func (r *AwsARNHardcodedRule) Check(runner tflint.Runner) error {
44+
func (r *AwsMetaHardcodedRule) Check(runner tflint.Runner) error {
4545
arnRegionPattern := awsmeta.GetARNRegionPattern()
4646
arnPartitionPattern := awsmeta.GetPartitionPattern()
4747

rules/aws_arn_hardcoded_test.go renamed to rules/aws_meta_hardcoded_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ import (
66
"github.com/terraform-linters/tflint-plugin-sdk/helper"
77
)
88

9-
func Test_AwsARNHardcodedRule(t *testing.T) {
9+
func Test_AwsMetaHardcodedRule(t *testing.T) {
1010
tests := []struct {
1111
Name string
1212
Content string
@@ -150,7 +150,7 @@ resource "aws_s3_bucket" "test" {
150150
},
151151
}
152152

153-
rule := NewAwsARNHardcodedRule()
153+
rule := NewAwsMetaHardcodedRule()
154154

155155
for _, test := range tests {
156156
t.Run(test.Name, func(t *testing.T) {

0 commit comments

Comments
 (0)