bridgecrewio / yor

Extensible auto-tagger for your IaC files. The ultimate way to link entities in the cloud back to the codified resource which created it.
https://www.yor.io
Apache License 2.0
827 stars 123 forks source link

Allow to add inline ignore for tagging terraform resource #299

Closed tommy31 closed 1 year ago

tommy31 commented 2 years ago

To prevent resource deletion when using depend_on meta argument we would like to ignore some resource tagging.

The best solution should be to add inline comment to specify to ignore tagging

Solution 1:

# main.tf

# yor:ignore
module.vpc_dev {
...
}

Solution 2:

# main.tf

# yor:ignore:module.vpc_dev

module.vpc_dev {
...
}

module.vpc_prod {
...
}
jgrumboe commented 2 years ago

Hi @tommy31 I'm not a maintainer, but I would like to understand the need of this. What do you mean with prevent resource deletion?

To prevent ressource deletion when using depend_on meta argument we would like to ignore some ressource tagging.

Could you give an example behavior of what's happening?

lonegunmanb commented 2 years ago

Hi @jgrumboe , I think what @tommy31 means is skip tagging some resource by adding ignore annotation in comment. For his solution 2, the module.vpc_dev won't be tagged.

tommy31 commented 2 years ago

Hi @jgrumboe / @lonegunmanb,

We had an issue after adding Yor to an old project who use a lot of depend_on between terraform ressources and in our case adding new tag to some ressources force other ressources that depend on it to be recreated, wich in our case are too critical.

That's why, as @lonegunmanb says, we would like a way to tell yor to avoid tagging some ressource and a common way to do it is by using inline comment.

Hope this help you to understand my needs.

JamesWoolfenden commented 1 year ago

This requires modification of how the HCL parser works, there is already a method for excluding untaggable resources from analysis although this does require a code change.

stale[bot] commented 1 year ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.