terraform-compliance / cli

a lightweight, security focused, BDD test framework against terraform.
https://terraform-compliance.com
MIT License
1.35k stars 152 forks source link

Can not find aws_msk_cluster defined in target terraform plan #715

Open doggoiswow opened 1 year ago

doggoiswow commented 1 year ago

Description

tf-compliance is unable to find Amazon MSK cluster resource from the plan.out.json file

To Reproduce

Feature File:

Feature: Test for properties on Kafka
    Test for broker logs, broker nodes and encryption
    Scenario: kafka must have broker logs enabled
        Given I have aws msk cluster resource configured
        Then it must have logging_info
        Then it must have broker_logs enabled

    Scenario: kafka version test
        Given I have aws_msk_cluster defined
        When it has kafka_version
        Then its kafka_version must be 2.8.0

Plan File: { "address": "aws_msk_cluster.general-kafka-cluster", "mode": "managed", "type": "aws_msk_cluster", "name": "some-kafka-cluster", "provider_config_key": "aws", "expressions": { "broker_node_group_info": [ { "client_subnets": { "references": [ "data.something.value" ] }, "instance_type": { "references": [ "var.kafka_type" ] }, "security_groups": { "references": [ "aws_security_group.some_sg.id", "aws_security_group.some1_sg" ] }, "storage_info": [ { "ebs_storage_info": [ { "volume_size": { "references": [ "var.kafka_size" ] } } ] } ] } ], "cluster_name": { "references": [ "var.pre_name" ] }, "encryption_info": [ { "encryption_in_transit": [ { "client_broker": { "constant_value": "TLS" }, "in_cluster": { "constant_value": true } } ] } ], "enhanced_monitoring": { "references": [ "var.monitoring_level" ] }, "kafka_version": { "references": [ "var.kafka_version" ] }, "logging_info": [ { "broker_logs": [ { "s3": [ { "bucket": { "references": [ "var.prefix" ] }, "enabled": { "constant_value": true }, "prefix": { "references": [ "var.environment" ] } } ] } ] } ], "number_of_broker_nodes": { "references": [ "var.kafka_number_brokers" ] }, "tags": { "references": [ "var.pre_name", ] }, "timeouts": { "update": { "constant_value": "3h" } } }, "schema_version": 0, "count_expression": { "references": [ "var.enable_services[\"kafka\"]" ] } }

Sample Terraform Code:

resource "aws_msk_cluster" "some-kafka-cluster" {
  cluster_name           = "${var.pre_name}"
  kafka_version          = var.kafka_version
  number_of_broker_nodes = var.kafka_number_brokers
  broker_node_group_info {
    instance_type = var.kafka_inst_type
    # ebs_volume_size = var.kafka_ebs_vol_size
    client_subnets = [
      data.some.value
    ]
    storage_info {
      ebs_storage_info {
        volume_size = var.kafka_ebs_vol_size
      }
    }
    security_groups = [aws_security_group.some1.id]
  }
  enhanced_monitoring = var.monitoring_level
  encryption_info {
    encryption_in_transit {
      client_broker = "TLS"
      in_cluster    = true
    }
  }
  tags = {
    Name                 = "${var.pre_name}"
  }
  logging_info {
    broker_logs {
      s3 {
        enabled = true
        bucket  = "${var.prefix}-kafka-service-logs"
        prefix  = "${var.environment}-kafka-cluster"
      }
    }
  }
  timeouts {
    update = "3h"
  }
  lifecycle {
    ignore_changes = [
      broker_node_group_info.0.storage_info
    ]
  }
}

Used terraform-compliance Parameters: -p and -f only

Running via Docker: No

Error Output: Scenario: kafka must have broker logs enabled 💡 SKIPPING: Can not find aws msk cluster defined in target terraform plan. Given I have aws msk cluster resource configured Then it must have logging_info Then it must have broker_logs enabled

Scenario: kafka version test
    💡 SKIPPING: Can not find aws_msk_cluster defined in target terraform plan.
    Given I have aws_msk_cluster defined
    When it has kafka_version
    Then its kafka_version must be 2.8.0

Expected Behavior: Terraform-compliance must be able to find the aws_msk_resource resource and perform negative test

Tested Versions:

Additional Context: The terraform plan snippet is present under configuration/root_module