🧬Teraform Compliance - AWS

This example contains a set of commands to manage different Terraform environments. It uses Docker Compose to provide a consistent and reproducible environment.

Setup

Before using these commands, you need to install Docker Compose.

Configuration

The ENVIRONMENT variable can be set to specify which environment to use. The default value is dev. The configuration files for the specified environment should have the following naming conventions:

• Backend configuration file: ${ENVIRONMENT}.backend

• Terraform variables file: ${ENVIRONMENT}.tfvars

• Terraform plan file: ${ENVIRONMENT}.plan

• Terraform state key: ${ENVIRONMENT}.tfstate

Usage

To use this repository, you need to create a .env file with the desired environment name:

ENVIRONMENT=dev

The available commands are:

make init

This command initializes the Terraform state file. It uses the TF_BACKEND_CONFIG and TF_STATE_KEY variables defined in the Makefile to configure the backend.

make validate

This command validates the syntax of the current Terraform configuration.

make plan

This command generates a Terraform plan as an output file. It uses the TF_VARIABLES and TF_PLAN variables defined in the Makefile.

make comply

This command tests the Terraform Plan output against a set of security and compliance / company rules against Infrastructure as Code, using Terraform Compliance.

make apply

This command deploys infrastructure with an expected Terraform plan file. It uses the TF_VARIABLES variable defined in the Makefile.

make destroy

This command destroys the Terraform-deployed resources.

make clean

This command removes leftover Terraform configuration and any leftover Docker networks.

Makefile

.SILENT:
.PHONY: validate plan comply apply destroy init clean

# Default variables
ENVIRONMENT ?= dev

# Terraform related configuration
TF_BACKEND_CONFIG = $(ENVIRONMENT).backend
TF_VARIABLES = $(ENVIRONMENT).tfvars
TF_PLAN = $(ENVIRONMENT).plan
TF_STATE_KEY = $(ENVIRONMENT).tfstate

# Initialise Terraform state file
init: clean
	docker-compose run \
		--rm \
		--entrypoint terraform \
		terraform init -backend-config=$(TF_BACKEND_CONFIG) -backend-config=key=$(TF_STATE_KEY) -reconfigure

# Validate syntax on current Terraform configuration
validate: init
	docker-compose run \
		--rm \
		--entrypoint terraform \
		terraform validate

# Generate a Terraform plan as an output file
plan: init
	echo "Building Terraform Plan"
	docker-compose run \
		--rm \
		--entrypoint terraform \
		terraform plan -var-file=$(TF_VARIABLES) -out $(TF_PLAN)

# Run compliance rules against Terraform plan file
comply:
	echo "Running Terraform Compliance Rules"
	docker-compose run \
		--rm \
		--entrypoint terraform-compliance \
		terraform-compliance --planfile $(TF_PLAN) --features /app/infra/tests/compliance

# Deploy infrastructure with an expected Terraform plan file
apply: plan
	echo "Deploying Terraform Plan"
	docker-compose run \
		--rm \
		--entrypoint terraform \
		terraform apply -auto-approve -var-file=$(TF_VARIABLES)

# Destroy Terraform deployed resources
destroy: init
	echo "Destroying Terraform Infrastructure"
	docker-compose run \
		--rm \
		--entrypoint terraform \
		terraform destroy -auto-approve

# Remove left over terraform configuration and any left over docker networks
clean:
	echo "Removing terraform config and removing orphaned docker networks"
	docker-compose run \
		--entrypoint="rm -rf .terraform" terraform
	docker-compose down \
		--remove-orphans 2>/dev/null

docker-compliance.yml