bridgecrewio / yor

Extensible auto-tagger for your IaC files. The ultimate way to link entities in the cloud back to the codified resource which created it.
https://www.yor.io
Apache License 2.0
825 stars 123 forks source link

Proposal for improving terraform taggable resources list #374

Closed lonegunmanb closed 1 year ago

lonegunmanb commented 1 year ago

I found that the azurerm resources from the taggable resource list are not update-to-date. It's very difficult to maintain this list manually every time a new provider version has been released. I assume that we also have the same problem with aws and gcp resources.

I have a personal repo named terraform-azurerm-schema, it runs terraform providers schema command and extracts resource schemas returned by Terraform provider plugin, convert the schemas into go code. With the help of this library, I can detect the missing resources by the following test (that's how I compose #373 and #371):

package structure

import (
    "strings"
    "testing"

    schema "github.com/lonegunmanb/terraform-azurerm-schema/v3/generated"
)

func TestMissingTaggableAzureResource(t *testing.T) {
    taggableAzureResource := make(map[string]struct{}, 0)
    for _, r := range TfTaggableResourceTypes {
        if strings.HasPrefix(r, "azurerm_") {
            taggableAzureResource[r] = struct{}{}
        }
    }
    for name, r := range schema.Resources {
        _, ok := r.Block.Attributes["tags"]
        if !ok {
            continue
        }
        _, ok = taggableAzureResource[name]
        if !ok {
            t.Errorf("%s should be taggable", name)
        }
    }
}

We can access any resources by calling the generated go code. I'd like to improve yor by two possible ways:

  1. Add unit tests to ensure that the current taggable resources list is correct.
  2. Replace the current static taggable resources list by calling the generated go code.

Now I have the schema repo for the following provider:

I can add aws and gcp schema repo. All schema repos have cronjob that checks whether there's new version every 6 hours. Once a new provider version has been released, a corresponding schema tag version would be generated and published.

I'd like to hear your thought @nimrodkor @gruebel

nimrodkor commented 1 year ago

Very interesting @lonegunmanb ! I'd love this as a contribution, i.e. your 2nd suggestion. 1 would cause failure unrelated to code changes, which is less nice... :) Of course you would need to add AWS, GCP support. And we will need to support the existing blocklisting mechanic, as some tags are not the regular tags / the documentation and provider are sometimes out of line.

lonegunmanb commented 1 year ago

Glad to hear that you like this idea, I'll study the blocklisting mechanic. aws and gcp schema repos are easy to create, I'll create these two schema repos very soon.

lonegunmanb commented 1 year ago

Another thought just jumped in @nimrodkor, every time a provider released a new major version, a lot of deprecated resources would be removed. If we depend on the latest schema only, yor could not generate tags for those old deprecated resources.

I would recommend we hardcode a static taggable resource list for previous major version when a new major version has been released, and we combine these list items together so yor can work for all major versions.

stale[bot] commented 1 year ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

lonegunmanb commented 1 year ago

Please keep it open as we're waiting for go-git's upgrade.

stale[bot] commented 1 year ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

lonegunmanb commented 1 year ago

Please keep it open, thanks.