Skip to content

Commit c5ba93a

Browse files
mariuxmariux
authored
Merge pull request #3 from mineiros-io/mariux/improve-policies
Finalize inline policy generation
2 parents a018661 + 1f8b831 commit c5ba93a

File tree

3 files changed

+119
-60
lines changed

3 files changed

+119
-60
lines changed

‎.semaphore/semaphore.yml

+15-13
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,27 @@
11
version: v1.0
2-
name: "terraform-aws-iam-user CI Pipeline"
2+
name: "CI/CD Pipeline"
33
agent:
44
machine:
55
type: e1-standard-2
66
os_image: ubuntu1804
77

8+
global_job_config:
9+
# secrets:
10+
# - name: TERRAFORM_AWS_TESTACCOUNT_CREDENTIALS
11+
# - name: private-ssh-key-with-iac-library-access
12+
prologue:
13+
commands:
14+
- checkout --use-cache
15+
# - chmod 400 ~/.ssh/id_rsa_iac_library
16+
# - ssh-add ~/.ssh/id_rsa_iac_library
17+
818
blocks:
919
- name: "Tests"
1020
task:
11-
# secrets:
12-
# - name: TERRAFORM_GITHUB_CREDENTIALS
13-
# - name: TERRAFORM_AWS_TESTACCOUNT_CREDENTIALS
14-
prologue:
15-
commands:
16-
- checkout --use-cache
1721
jobs:
1822
- name: "Pre Commit Hooks"
1923
commands:
20-
- make test/pre-commit-hooks
21-
22-
# There are no unit tests inside this repository since it acts as a code convention example only
23-
# - name: "Unit Tests"
24-
# commands:
25-
# - make test/unit-tests
24+
- make test/pre-commit
25+
- name: "Unit Tests"
26+
commands:
27+
- make test/unit-tests

‎Makefile

+70-43
Original file line numberDiff line numberDiff line change
@@ -1,60 +1,87 @@
1-
SHELL := /bin/bash
1+
# Set default shell to bash
2+
SHELL := /bin/bash -o pipefail
23

3-
MOUNT_TARGET_DIRECTORY = /app/src
4-
BUILD_TOOLS_DOCKER_REPO = mineiros/build-tools
4+
BUILD_TOOLS_VERSION ?= v0.4.0
5+
BUILD_TOOLS_DOCKER_REPO ?= mineiros/build-tools
6+
BUILD_TOOLS_DOCKER_IMAGE ?= ${BUILD_TOOLS_DOCKER_REPO}:${BUILD_TOOLS_VERSION}
57

6-
# Set default value for environment variable if there aren't set already
7-
ifndef BUILD_TOOLS_VERSION
8-
BUILD_TOOLS_VERSION := latest
8+
# if running in CI (e.g. Semaphore CI)
9+
# https://docs.semaphoreci.com/ci-cd-environment/environment-variables/#ci
10+
#
11+
# to disable TF_IN_AUTOMATION in CI set it to empty
12+
# https://www.terraform.io/docs/commands/environment-variables.html#tf_in_automation
13+
#
14+
# we are using GNU style quiet commands to disable set V to non-empty e.g. V=1
15+
# https://www.gnu.org/software/automake/manual/html_node/Debugging-Make-Rules.html
16+
#
17+
ifdef CI
18+
TF_IN_AUTOMATION ?= yes
19+
export TF_IN_AUTOMATION
20+
21+
V ?= 1
922
endif
1023

11-
ifndef BUILD_TOOLS_DOCKER_IMAGE
12-
BUILD_TOOLS_DOCKER_IMAGE := ${BUILD_TOOLS_DOCKER_REPO}:${BUILD_TOOLS_VERSION}
24+
ifndef NOCOLOR
25+
GREEN := $(shell tput -Txterm setaf 2)
26+
YELLOW := $(shell tput -Txterm setaf 3)
27+
WHITE := $(shell tput -Txterm setaf 7)
28+
RESET := $(shell tput -Txterm sgr0)
1329
endif
1430

15-
USER_UID := $(shell id -u)
16-
USER_GID := $(shell id -g)
31+
DOCKER_RUN_FLAGS += --rm
32+
DOCKER_RUN_FLAGS += -v ${PWD}:/app/src
33+
DOCKER_RUN_FLAGS += -e TF_IN_AUTOMATION
34+
DOCKER_RUN_FLAGS += -e USER_UID=$(shell id -u)
35+
36+
DOCKER_SSH_FLAGS += -e SSH_AUTH_SOCK=/ssh-agent
37+
DOCKER_SSH_FLAGS += -v ${SSH_AUTH_SOCK}:/ssh-agent
38+
39+
DOCKER_AWS_FLAGS += -e AWS_ACCESS_KEY_ID
40+
DOCKER_AWS_FLAGS += -e AWS_SECRET_ACCESS_KEY
41+
DOCKER_AWS_FLAGS += -e AWS_SESSION_TOKEN
1742

18-
GREEN := $(shell tput -Txterm setaf 2)
19-
YELLOW := $(shell tput -Txterm setaf 3)
20-
WHITE := $(shell tput -Txterm setaf 7)
21-
RESET := $(shell tput -Txterm sgr0)
43+
DOCKER_FLAGS += ${DOCKER_RUN_FLAGS}
44+
DOCKER_RUN_CMD = docker run ${DOCKER_FLAGS} ${BUILD_TOOLS_DOCKER_IMAGE}
2245

23-
.DEFAULT_GOAL := help
46+
.PHONY: default
47+
default: help
2448

25-
.PHONY: test/pre-commit-hooks
26-
## Mounts the working directory inside a docker container and runs the pre-commit hooks
27-
test/pre-commit-hooks:
28-
@echo "${GREEN}Start running the pre-commit hooks with docker${RESET}"
29-
@docker run --rm \
30-
-u ${USER_UID}:${USER_GID} \
31-
-v ${PWD}:${MOUNT_TARGET_DIRECTORY} \
32-
${BUILD_TOOLS_DOCKER_IMAGE} \
33-
sh -c "pre-commit run -a"
49+
## Run pre-commit hooks in build-tools docker container.
50+
.PHONY: test/pre-commit
51+
test/pre-commit: DOCKER_FLAGS += ${DOCKER_SSH_FLAGS}
52+
test/pre-commit:
53+
$(call docker-run,pre-commit run -a)
3454

55+
## Run go tests hooks in build-tools docker container.
3556
.PHONY: test/unit-tests
36-
## Mounts the working directory inside a new container and runs the Go tests. Requires $AWS_ACCESS_KEY_ID and $AWS_SECRET_ACCESS_KEY to be set
37-
# test/unit-tests:
38-
# @echo "${GREEN}Start running the unit tests with docker${RESET}"
39-
# @docker run --rm \
40-
# -e AWS_ACCESS_KEY_ID \
41-
# -e AWS_SECRET_ACCESS_KEY \
42-
# -u ${USER_UID}:${USER_GID} \
43-
# -v ${PWD}:${MOUNT_TARGET_DIRECTORY} \
44-
# ${BUILD_TOOLS_DOCKER_IMAGE} \
45-
# go test -v -timeout 45m -parallel 128 test/example_test.go
57+
test/unit-tests: DOCKER_FLAGS += ${DOCKER_SSH_FLAGS}
58+
test/unit-tests: DOCKER_FLAGS += ${DOCKER_AWS_FLAGS}
59+
test/unit-tests:
60+
@echo "${YELLOW}No tests defined.${RESET}"
61+
# $(call go-test,tests)
62+
63+
## Clean up cache and temporary files
64+
.PHONY: clean
65+
clean:
66+
$(call rm-command,.terraform)
4667

47-
.PHONY: help
4868
## Display help for all targets
69+
.PHONY: help
4970
help:
50-
@awk '/^[a-zA-Z_0-9%:\\\/-]+:/ { \
51-
msg = match(lastLine, /^## (.*)/); \
71+
@awk '/^.PHONY: / { \
72+
msg = match(lastLine, /^## /); \
5273
if (msg) { \
53-
cmd = $$1; \
54-
msg = substr(lastLine, RSTART + 3, RLENGTH); \
55-
gsub("\\\\", "", cmd); \
56-
gsub(":+$$", "", cmd); \
57-
printf " \x1b[32;01m%-35s\x1b[0m %s\n", cmd, msg; \
74+
cmd = substr($$0, 9, 100); \
75+
msg = substr(lastLine, 4, 1000); \
76+
printf " ${GREEN}%-30s${RESET} %s\n", cmd, msg; \
5877
} \
5978
} \
60-
{ lastLine = $$0 }' $(MAKEFILE_LIST) | sort -u
79+
{ lastLine = $$0 }' $(MAKEFILE_LIST)
80+
81+
# define helper functions
82+
quiet-command = $(if ${V},${1},$(if ${2},@echo ${2} && ${1}, @${1}))
83+
84+
docker-run = $(call quiet-command,${DOCKER_RUN_CMD} ${1} | cat,"${YELLOW}[DOCKER RUN] ${GREEN}${1}${RESET}")
85+
go-test = $(call quiet-command,${DOCKER_RUN_CMD} go test -v -timeout 45m -parallel 128 ${1} | cat,"${YELLOW}[TEST] ${GREEN}${1}${RESET}")
86+
87+
rm-command = $(call quiet-command,rm -rf ${1},"${YELLOW}[CLEAN] ${GREEN}${1}${RESET}")

‎main.tf

+34-4
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,40 @@ data "aws_iam_policy_document" "policy" {
2727
for_each = var.policy_statements
2828

2929
content {
30-
actions = try(statement.value.actions, null)
31-
effect = try(statement.value.effect, null)
32-
resources = try(statement.value.resources, null)
33-
sid = try(statement.value.sid, null)
30+
sid = try(statement.value.sid, null)
31+
effect = try(statement.value.effect, null)
32+
actions = try(statement.value.actions, null)
33+
not_actions = try(statement.value.not_actions, null)
34+
resources = try(statement.value.resources, null)
35+
not_resources = try(statement.value.not_resources, null)
36+
37+
dynamic "principals" {
38+
for_each = try(statement.value.principals, [])
39+
40+
content {
41+
type = principals.value.type
42+
identifiers = principals.value.identifiers
43+
}
44+
}
45+
46+
dynamic "not_principals" {
47+
for_each = try(statement.value.not_principals, [])
48+
49+
content {
50+
type = not_principals.value.type
51+
identifiers = not_principals.value.identifiers
52+
}
53+
}
54+
55+
dynamic "condition" {
56+
for_each = try(statement.value.conditions, [])
57+
58+
content {
59+
test = condition.value.test
60+
variable = condition.value.variable
61+
values = condition.value.values
62+
}
63+
}
3464
}
3565
}
3666
}

0 commit comments

Comments
 (0)