Terraform (AWS) の例

Terraform Planの出力は、TerraformプロジェクトをTemplate Scanner APIで読み取り可能な単一のファイルにパッケージ化するための仲介として使用されます。

{ "format_version": "0.1", "terraform_version": "0.15.3", "planned_values": { "root_module": { "resources": [ { "address": "aws_dynamodb_table.dynamodb003S1", "mode": "managed", "type": "aws_dynamodb_table", "name": "dynamodb003S1", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 1, "values": { "attribute": [{ "name": "TestTableHashKey", "type": "S" }], "billing_mode": "PAY_PER_REQUEST", "global_secondary_index": [], "hash_key": "TestTableHashKey", "local_secondary_index": [], "name": "mydynamodbtable", "point_in_time_recovery": [{ "enabled": true }], "range_key": null, "read_capacity": null, "replica": [], "server_side_encryption": [ { "enabled": true, "kms_key_arn": "arn:aws:kms:us-east-1:123456789012:key/abcd1234-abcd-1234-abcd-1234abcd1234" } ], "stream_enabled": true, "stream_view_type": "NEW_AND_OLD_IMAGES", "tags": { "Environment": "test", "Owner": "Sample Team" }, "tags_all": { "Environment": "test", "Owner": "Sample Team" }, "timeouts": null, "ttl": [], "write_capacity": null } } ] } }, "resource_changes": [ { "address": "aws_dynamodb_table.dynamodb003S1", "mode": "managed", "type": "aws_dynamodb_table", "name": "dynamodb003S1", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": ["create"], "before": null, "after": { "attribute": [{ "name": "TestTableHashKey", "type": "S" }], "billing_mode": "PAY_PER_REQUEST", "global_secondary_index": [], "hash_key": "TestTableHashKey", "local_secondary_index": [], "name": "mydynamodbtable", "point_in_time_recovery": [{ "enabled": true }], "range_key": null, "read_capacity": null, "replica": [], "server_side_encryption": [ { "enabled": true, "kms_key_arn": "arn:aws:kms:us-east-1:123456789012:key/abcd1234-abcd-1234-abcd-1234abcd1234" } ], "stream_enabled": true, "stream_view_type": "NEW_AND_OLD_IMAGES", "tags": { "Environment": "test", "Owner": "Sample Team" }, "tags_all": { "Environment": "test", "Owner": "Sample Team" }, "timeouts": null, "ttl": [], "write_capacity": null }, "after_unknown": { "arn": true, "attribute": [{}], "global_secondary_index": [], "id": true, "local_secondary_index": [], "point_in_time_recovery": [{}], "replica": [], "server_side_encryption": [{}], "stream_arn": true, "stream_label": true, "tags": {}, "tags_all": {}, "ttl": [] }, "before_sensitive": false, "after_sensitive": { "attribute": [{}], "global_secondary_index": [], "local_secondary_index": [], "point_in_time_recovery": [{}], "replica": [], "server_side_encryption": [{}], "tags": {}, "tags_all": {}, "ttl": [] } } } ], "configuration": { "provider_config": { "aws": { "name": "aws", "version_constraint": "~\u003e 3.27", "expressions": { "region": { "constant_value": "us-east-2" } } } }, "root_module": { "resources": [ { "address": "aws_dynamodb_table.dynamodb003S1", "mode": "managed", "type": "aws_dynamodb_table", "name": "dynamodb003S1", "provider_config_key": "aws", "expressions": { "attribute": [ { "name": { "constant_value": "TestTableHashKey" }, "type": { "constant_value": "S" } } ], "billing_mode": { "constant_value": "PAY_PER_REQUEST" }, "hash_key": { "constant_value": "TestTableHashKey" }, "name": { "constant_value": "mydynamodbtable" }, "point_in_time_recovery": [ { "enabled": { "constant_value": true } } ], "server_side_encryption": [ { "enabled": { "constant_value": true }, "kms_key_arn": { "constant_value": "arn:aws:kms:us-east-1:123456789012:key/abcd1234-abcd-1234-abcd-1234abcd1234" } } ], "stream_enabled": { "constant_value": true }, "stream_view_type": { "constant_value": "NEW_AND_OLD_IMAGES" }, "tags": { "constant_value": { "Environment": "test", "Owner": "Sample Team" } } }, "schema_version": 1 } ] } } }

次のbashスクリプトは、テラフォームプランファイルの作成とテンプレートスキャナAPIの呼び出しを処理します。 Terraformプロジェクトと同じディレクトリでスクリプトを実行してください。

#!/usr/bin/env bash # Scans a template file # Requires "jq" (https://stedolan.github.io/jq/) to be installed api_key="Your Trend Vision One API Key" api_base_url="https://api.xdr.trendmicro.com" terraform plan -out=outputfile content=$(terraform show -json outputfile | jq '.' -MRs) payload="{\"type\":\"terraform-template\",\"content\":${content}}" echo Request: echo ${payload} | jq '.' -M echo Response: curl -s -X POST \ -H "Authorization: Bearer ${api_key}" \ -H "Content-Type: application/json" \ ${api_base_url}/beta/cloudPosture/scanTemplate \ --data-binary "${payload}" | jq '.' -M