Merge pull request #176 from SumoLogic/SUMO-238066-TF-checkov-changes

SUMO-238066: TF checkov changes

.github/workflows/tf-test.yml

@@ -0,0 +1,65 @@
+name: "TF template tests"
+on: [workflow_dispatch, pull_request]
+
+jobs:
+  ValidateTF:
+    runs-on: ubuntu-latest
+    name: "Validate Terraform module for AWSO"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: terraform validate
+        uses: dflook/terraform-validate@v1
+        with:
+          path: aws-observability-terraform/
+
+  ValidateLinting:
+    runs-on: ubuntu-latest
+    name: "Terraform template linting verification for AWSO"
+
+    steps:
+    - uses: actions/checkout@v4
+      name: Checkout source code
+
+    - name: Change directory
+      run: cd aws-observability-terraform/
+
+    - uses: actions/cache@v4
+      name: Cache plugin dir
+      with:
+        path: ~/.tflint.d/plugins
+        key: ubuntu-latest-tflint-${{ hashFiles('.tflint.hcl') }}
+
+    - uses: terraform-linters/setup-tflint@v4
+      name: Setup TFLint
+      with:
+        tflint_version: v0.50.3
+
+    - name: Show version
+      run: tflint --version
+
+    - name: Init TFLint
+      run: tflint --init
+      env:
+        GITHUB_TOKEN: ''
+
+    - name: Run TFLint
+      run: tflint --recursive -f checkstyle
+
+  TFSecurityChecks:
+    name: "terraform template tests using checkov for AWSO"
+    runs-on: "ubuntu-latest"
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v3
+
+      - uses: bridgecrewio/checkov-action@master
+        with:
+          directory: 'aws-observability-terraform/'
+          quiet: true
+          framework: terraform
+          output_format: cli
+          output_bc_ids: false
+          download_external_modules: true
+          skip_check: CKV_AWS_26,CKV_AWS_35,CKV_AWS_67,CKV_AWS_36,CKV_AWS_252,CKV_AWS_158,CKV_AWS_338,CKV_AWS_117,CKV_AWS_115,CKV_AWS_173,CKV_AWS_50,CKV_AWS_241,CKV_AWS_240,CKV2_AWS_6,CKV2_AWS_62,CKV_AWS_144,CKV_AWS_18,CKV_AWS_21,CKV_AWS_145,CKV_TF_1,CKV_AWS_27,CKV_AWS_124,CKV2_AWS_10,CKV_AWS_272,CKV2_AWS_61

aws-observability-terraform/.tflint.hcl

@@ -0,0 +1,10 @@
+plugin "aws" {
+    enabled = true
+    version = "0.30.0"
+    source  = "github.com/terraform-linters/tflint-ruleset-aws"
+}
+
+plugin "terraform" {
+  enabled = true
+  preset  = "recommended"
+}