Skip to content

Commit 1f9f640

Browse files
oniiceoniice
committed
feat(examples): added passing and failing examples and docs
Signed-off-by: Fred Myerscough <oniice@gmail.com>
1 parent a22cb78 commit 1f9f640

File tree

9 files changed

+431
-273
lines changed

9 files changed

+431
-273
lines changed

‎README.md‎

Lines changed: 9 additions & 160 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ TODO: This template repository does not contain release binaries, so this instal
1818
You can install the plugin with `tflint --init`. Declare a config in `.tflint.hcl` as follows:
1919

2020
```hcl
21-
plugin "aws-multi" {
21+
plugin "aws-meta" {
2222
enabled = true
2323
2424
version = "0.1.0"
@@ -30,164 +30,13 @@ plugin "aws-multi" {
3030

3131
|Name|Description|Severity|Enabled|Link|
3232
| --- | --- | --- | --- | --- |
33-
|aws_iam_role_policy_hardcoded_region|Validates that there are no hardcoded AWS regions in IAM role policy documents|WARNING|✔||
34-
|aws_iam_role_policy_hardcoded_partition|Validates that there are no hardcoded AWS partitions in IAM role policy documents|WARNING|✔||
35-
|aws_iam_policy_hardcoded_region|Validates that there are no hardcoded AWS regions in IAM policy documents|WARNING|✔||
36-
|aws_iam_policy_hardcoded_partition|Validates that there are no hardcoded AWS partitions in IAM policy documents|WARNING|✔||
37-
|aws_provider_hardcoded_region|Validates that there are no hardcoded AWS regions or credentials in provider configuration|WARNING|✔||
38-
39-
### Rule Details
40-
41-
#### aws_iam_role_policy_hardcoded_region
42-
43-
This rule checks `aws_iam_role_policy` resources for hardcoded AWS regions in policy documents. It examines both JSON policy strings and structured policy documents to detect:
44-
45-
- Hardcoded regions in ARNs within policy statements (e.g., `arn:aws:s3:::bucket/us-east-1/*`)
46-
- Direct region references in policy JSON
47-
48-
**Example violations:**
49-
```hcl
50-
resource "aws_iam_role_policy" "bad" {
51-
policy = jsonencode({
52-
Statement = [{
53-
Effect = "Allow"
54-
Action = "s3:GetObject"
55-
Resource = "arn:aws:s3:::bucket/us-east-1/*" # ❌ Hardcoded region
56-
}]
57-
})
58-
}
59-
```
60-
61-
**Recommended fix:**
62-
```hcl
63-
resource "aws_iam_role_policy" "good" {
64-
policy = jsonencode({
65-
Statement = [{
66-
Effect = "Allow"
67-
Action = "s3:GetObject"
68-
Resource = "arn:aws:s3:::bucket/${data.aws_region.current.name}/*" # ✅ Dynamic region
69-
}]
70-
})
71-
}
72-
```
73-
74-
#### aws_iam_role_policy_hardcoded_partition
75-
76-
This rule checks `aws_iam_role_policy` resources for hardcoded AWS partitions in policy documents. It detects:
77-
78-
- Hardcoded partitions in ARNs (e.g., `arn:aws:`, `arn:aws-cn:`, `arn:aws-us-gov:`)
79-
80-
**Example violations:**
81-
```hcl
82-
resource "aws_iam_role_policy" "bad" {
83-
policy = jsonencode({
84-
Statement = [{
85-
Effect = "Allow"
86-
Action = "s3:*"
87-
Resource = "arn:aws:s3:::bucket/*" # ❌ Hardcoded partition
88-
}]
89-
})
90-
}
91-
```
92-
93-
**Recommended fix:**
94-
```hcl
95-
resource "aws_iam_role_policy" "good" {
96-
policy = jsonencode({
97-
Statement = [{
98-
Effect = "Allow"
99-
Action = "s3:*"
100-
Resource = "arn:${data.aws_partition.current.partition}:s3:::bucket/*" # ✅ Dynamic partition
101-
}]
102-
})
103-
}
104-
```
105-
106-
#### aws_iam_policy_hardcoded_region
107-
108-
This rule checks `aws_iam_policy` resources for hardcoded AWS regions in policy documents. Similar to the role policy rule, it examines:
109-
110-
- Hardcoded regions in ARNs within policy statements
111-
- Direct region references in policy JSON
112-
113-
**Example violations:**
114-
```hcl
115-
resource "aws_iam_policy" "bad" {
116-
policy = jsonencode({
117-
Statement = [{
118-
Effect = "Allow"
119-
Action = "lambda:InvokeFunction"
120-
Resource = "arn:aws:lambda:eu-west-1:123456789012:function:*" # ❌ Hardcoded region
121-
}]
122-
})
123-
}
124-
```
125-
126-
**Recommended fix:**
127-
```hcl
128-
resource "aws_iam_policy" "good" {
129-
policy = jsonencode({
130-
Statement = [{
131-
Effect = "Allow"
132-
Action = "lambda:InvokeFunction"
133-
Resource = "arn:aws:lambda:${data.aws_region.current.name}:123456789012:function:*" # ✅ Dynamic region
134-
}]
135-
})
136-
}
137-
```
138-
139-
#### aws_iam_policy_hardcoded_partition
140-
141-
This rule checks `aws_iam_policy` resources for hardcoded AWS partitions in policy documents. It detects:
142-
143-
- Hardcoded partitions in ARNs within policy statements
144-
145-
**Example violations:**
146-
```hcl
147-
resource "aws_iam_policy" "bad" {
148-
policy = jsonencode({
149-
Statement = [{
150-
Effect = "Allow"
151-
Action = "sqs:*"
152-
Resource = "arn:aws-us-gov:sqs:*:*:*" # ❌ Hardcoded partition
153-
}]
154-
})
155-
}
156-
```
157-
158-
**Recommended fix:**
159-
```hcl
160-
resource "aws_iam_policy" "good" {
161-
policy = jsonencode({
162-
Statement = [{
163-
Effect = "Allow"
164-
Action = "sqs:*"
165-
Resource = "arn:${data.aws_partition.current.partition}:sqs:*:*:*" # ✅ Dynamic partition
166-
}]
167-
})
168-
}
169-
```
170-
171-
#### aws_provider_hardcoded_region
172-
173-
This rule checks AWS provider configurations for security and flexibility issues. It detects:
174-
175-
- Hardcoded regions in provider `region` attribute
176-
- Hardcoded AWS access keys and secret keys (security risk)
177-
- Hardcoded regions in `assume_role` ARNs
178-
179-
**Example violations:**
180-
```hcl
181-
provider "aws" {
182-
region = "us-east-1" # ❌ Hardcoded region
183-
}
184-
```
185-
186-
**Recommended fix:**
187-
```hcl
188-
provider "aws" {
189-
region = var.aws_region # ✅ Use variables
190-
}
191-
```
33+
|aws_iam_role_policy_hardcoded_region|Validates that there are no hardcoded AWS regions in IAM role policy documents|WARNING|✔|[docs](docs/rules.md#aws_iam_role_policy_hardcoded_region)|
34+
|aws_iam_role_policy_hardcoded_partition|Validates that there are no hardcoded AWS partitions in IAM role policy documents|WARNING|✔|[docs](docs/rules.md#aws_iam_role_policy_hardcoded_partition)|
35+
|aws_iam_policy_hardcoded_region|Validates that there are no hardcoded AWS regions in IAM policy documents|WARNING|✔|[docs](docs/rules.md#aws_iam_policy_hardcoded_region)|
36+
|aws_iam_policy_hardcoded_partition|Validates that there are no hardcoded AWS partitions in IAM policy documents|WARNING|✔|[docs](docs/rules.md#aws_iam_policy_hardcoded_partition)|
37+
|aws_provider_hardcoded_region|Validates that there are no hardcoded AWS regions in provider configuration|WARNING|✔|[docs](docs/rules.md#aws_provider_hardcoded_region)|
38+
|aws_arn_hardcoded|Validates that there are no hardcoded AWS regions or partitions in ARN values across all resource types|WARNING|✔|[docs](docs/rules.md#aws_arn_hardcoded)|
39+
40+
For detailed examples and usage information, see the [Rule Details documentation](docs/rules.md).
19241

19342

‎docs/rules.md‎

Lines changed: 193 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
# Rule Details
2+
3+
## aws_iam_role_policy_hardcoded_region
4+
5+
This rule checks `aws_iam_role_policy` resources for hardcoded AWS regions in policy documents. It examines both JSON policy strings and structured policy documents to detect:
6+
7+
- Hardcoded regions in ARNs within policy statements (e.g., `arn:aws:s3:::bucket/us-east-1/*`)
8+
- Direct region references in policy JSON
9+
10+
**Example violations:**
11+
```hcl
12+
resource "aws_iam_role_policy" "bad" {
13+
policy = jsonencode({
14+
Statement = [{
15+
Effect = "Allow"
16+
Action = "s3:GetObject"
17+
Resource = "arn:aws:s3:::bucket/us-east-1/*" # ❌ Hardcoded region
18+
}]
19+
})
20+
}
21+
```
22+
23+
**Recommended fix:**
24+
```hcl
25+
resource "aws_iam_role_policy" "good" {
26+
policy = jsonencode({
27+
Statement = [{
28+
Effect = "Allow"
29+
Action = "s3:GetObject"
30+
Resource = "arn:aws:s3:::bucket/${data.aws_region.current.name}/*" # ✅ Dynamic region
31+
}]
32+
})
33+
}
34+
```
35+
36+
## aws_iam_role_policy_hardcoded_partition
37+
38+
This rule checks `aws_iam_role_policy` resources for hardcoded AWS partitions in policy documents. It detects:
39+
40+
- Hardcoded partitions in ARNs (e.g., `arn:aws:`, `arn:aws-cn:`, `arn:aws-us-gov:`)
41+
42+
**Example violations:**
43+
```hcl
44+
resource "aws_iam_role_policy" "bad" {
45+
policy = jsonencode({
46+
Statement = [{
47+
Effect = "Allow"
48+
Action = "s3:*"
49+
Resource = "arn:aws:s3:::bucket/*" # ❌ Hardcoded partition
50+
}]
51+
})
52+
}
53+
```
54+
55+
**Recommended fix:**
56+
```hcl
57+
resource "aws_iam_role_policy" "good" {
58+
policy = jsonencode({
59+
Statement = [{
60+
Effect = "Allow"
61+
Action = "s3:*"
62+
Resource = "arn:${data.aws_partition.current.partition}:s3:::bucket/*" # ✅ Dynamic partition
63+
}]
64+
})
65+
}
66+
```
67+
68+
## aws_iam_policy_hardcoded_region
69+
70+
This rule checks `aws_iam_policy` resources for hardcoded AWS regions in policy documents. Similar to the role policy rule, it examines:
71+
72+
- Hardcoded regions in ARNs within policy statements
73+
- Direct region references in policy JSON
74+
75+
**Example violations:**
76+
```hcl
77+
resource "aws_iam_policy" "bad" {
78+
policy = jsonencode({
79+
Statement = [{
80+
Effect = "Allow"
81+
Action = "lambda:InvokeFunction"
82+
Resource = "arn:aws:lambda:eu-west-1:123456789012:function:*" # ❌ Hardcoded region
83+
}]
84+
})
85+
}
86+
```
87+
88+
**Recommended fix:**
89+
```hcl
90+
resource "aws_iam_policy" "good" {
91+
policy = jsonencode({
92+
Statement = [{
93+
Effect = "Allow"
94+
Action = "lambda:InvokeFunction"
95+
Resource = "arn:aws:lambda:${data.aws_region.current.name}:123456789012:function:*" # ✅ Dynamic region
96+
}]
97+
})
98+
}
99+
```
100+
101+
## aws_iam_policy_hardcoded_partition
102+
103+
This rule checks `aws_iam_policy` resources for hardcoded AWS partitions in policy documents. It detects:
104+
105+
- Hardcoded partitions in ARNs within policy statements
106+
107+
**Example violations:**
108+
```hcl
109+
resource "aws_iam_policy" "bad" {
110+
policy = jsonencode({
111+
Statement = [{
112+
Effect = "Allow"
113+
Action = "sqs:*"
114+
Resource = "arn:aws-us-gov:sqs:*:*:*" # ❌ Hardcoded partition
115+
}]
116+
})
117+
}
118+
```
119+
120+
**Recommended fix:**
121+
```hcl
122+
resource "aws_iam_policy" "good" {
123+
policy = jsonencode({
124+
Statement = [{
125+
Effect = "Allow"
126+
Action = "sqs:*"
127+
Resource = "arn:${data.aws_partition.current.partition}:sqs:*:*:*" # ✅ Dynamic partition
128+
}]
129+
})
130+
}
131+
```
132+
133+
## aws_provider_hardcoded_region
134+
135+
This rule checks AWS provider configurations for hardcoded regions. It detects:
136+
137+
- Hardcoded regions in provider `region` attribute
138+
- Hardcoded regions in `assume_role` ARNs
139+
140+
**Example violations:**
141+
```hcl
142+
provider "aws" {
143+
region = "us-east-1" # ❌ Hardcoded region
144+
}
145+
```
146+
147+
**Recommended fix:**
148+
```hcl
149+
provider "aws" {
150+
region = var.aws_region # ✅ Use variables
151+
}
152+
```
153+
154+
## aws_arn_hardcoded
155+
156+
This is a comprehensive rule that checks ALL AWS resources for hardcoded regions and partitions in ARN values. It works by walking through all expressions in your Terraform files and detecting any string that looks like an ARN with hardcoded values.
157+
158+
This rule covers resource types including:
159+
- Lambda (permissions, event source mappings, functions)
160+
- SNS/SQS (subscriptions, queue policies)
161+
- CloudWatch (event targets, log subscriptions, alarms)
162+
- API Gateway (integrations, authorizers)
163+
- KMS (grants, aliases, keys)
164+
- Secrets Manager (rotations, policies)
165+
- ECS (services, task definitions)
166+
- RDS (instances, event subscriptions, clusters)
167+
- S3 (notifications, policies, access points)
168+
- And many more...
169+
170+
**Example violations:**
171+
```hcl
172+
resource "aws_lambda_permission" "test" {
173+
source_arn = "arn:aws:s3:us-east-1:123456789012:bucket/my-bucket" # ❌ Hardcoded region and partition
174+
}
175+
176+
resource "aws_kms_grant" "test" {
177+
key_id = "arn:aws:kms:eu-west-1:123456789012:key/12345678-1234-1234-1234-123456789012" # ❌ Hardcoded region and partition
178+
}
179+
```
180+
181+
**Recommended fixes:**
182+
```hcl
183+
data "aws_region" "current" {}
184+
data "aws_partition" "current" {}
185+
186+
resource "aws_lambda_permission" "test" {
187+
source_arn = "arn:${data.aws_partition.current.partition}:s3:${data.aws_region.current.name}:123456789012:bucket/my-bucket" # ✅ Dynamic
188+
}
189+
190+
resource "aws_kms_grant" "test" {
191+
key_id = "arn:${data.aws_partition.current.partition}:kms:${data.aws_region.current.name}:123456789012:key/12345678-1234-1234-1234-123456789012" # ✅ Dynamic
192+
}
193+
```

0 commit comments

Comments
 (0)