$ terraform console
Terraform console version 0.15.1

> 10 + 20
30

> "hello, world"
"hello, world"

> length("hello, world")
12

> substr("hello, world", 0, 5)
"hello"

> exit

# example.tf
provider "aws" {
  version = "2.70.0"
  region  = "us-west-2"
}

resource "aws_instance" "example" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"
}

$ tflint

example.tf
  on main.tf line 4:
  4:   version = "2.70.0"
     |     ^ Error: AWS provider version should be specified in the required format: X.Y.Z (e.g. 2.1.0)

Summary:
  Count: 1
  Invalid: 1
  Warnings: 0
  Errors: 1

package spacelift

# Note that the message here is dynamic and captures resource address to provide
# appropriate context to anyone affected by this policy. For the sake of your
# sanity and that of your colleagues, please a
#
# You can read more about plan policies here:
# https://docs.spacelift.io/concepts/policy/terraform-plan-policy

deny[sprintf(message, [resource.address])] {
 message := "Static AWS credentials are evil (%s)"

 resource := input.terraform.resource_changes[_]
 resource.change.actions[_] == "create"

 # This is what decides whether the rule captures a resource.
 # There may be an arbitrary number of conditions, and they all must
 # succeed for the rule to take effect.
 resource.type == "aws_iam_access_key"
}

# Learn more about sampling policy evaluations here:
# https://docs.spacelift.io/concepts/policy#sampling-policy-inputs
sample = true

$ terrascan scan -t aws
results:
  violations:
  - rule_name: scanOnPushDisabled
    description: Unscanned images may contain vulnerabilities
    rule_id: AWS.ECR.DataSecurity.High.0578
    severity: MEDIUM
    category: Data Security
    resource_name: scanOnPushDisabled
    resource_type: aws_ecr_repository
    file: ecr.tf
    line: 1
  count:
    low: 0
    medium: 1
    high: 0
    total: 1

from lark import Token

from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
from checkov.common.models.enums import CheckResult, CheckCategories

class S3PCIPrivateACL(BaseResourceCheck):
    def __init__(self):
        name = "Ensure PCI Scope buckets has private ACL (enable public ACL for non-pci buckets)"
        id = "CKV_AWS_999"
        supported_resources = ['aws_s3_bucket']
        # CheckCategories are defined in models/enums.py
        categories = [CheckCategories.BACKUP_AND_RECOVERY]
        guideline = "Follow the link to get more info https://docs.bridgecrew.io/docs"
        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, guideline=guideline)
  
  def scan_resource_conf(self, conf):
        """
            Looks for ACL configuration at aws_s3_bucket and Tag values:
            https://www.terraform.io/docs/providers/aws/r/s3_bucket.html
        :param conf: aws_s3_bucket configuration
        :return: <CheckResult>
        """
        if 'tags' in conf.keys():
            environment_tag = Token("IDENTIFIER", "Scope")
            if environment_tag in conf['tags'][0].keys():
                if conf['tags'][0][environment_tag] == "PCI":
                    if 'acl' in conf.keys():
                        acl_block = conf['acl']
                        if acl_block in [["public-read"], ["public-read-write"], ["website"]]:
                            return CheckResult.FAILED
        return CheckResult.PASSED

check = S3PCIPrivateACL()

checks:
- code: CUS001
  description: Custom check to ensure the CostCentre tag is applied to EC2 instances
  impact: By not having CostCentre we can't keep track of billing
  resolution: Add the CostCentre tag
  requiredTypes:
  - resource
  requiredLabels:
  - aws_instance
  severity: ERROR
  matchSpec:
    name: tags
    action: contains
    value: CostCentre
  errorMessage: The required CostCentre tag was missing
  relatedLinks:
  - http://internal.acmecorp.com/standards/aws/tagging.html

Found missing resources:
  aws_s3_bucket:
    - driftctl-bucket-test-2
Found resources not covered by IaC:
  aws_s3_bucket:
    - driftctl-bucket-test-3
Found changed resources:
  - driftctl-bucket-test-1 (aws_s3_bucket):
    ~ Versioning.0.Enabled: false => true
Found 3 resource(s)
 - 33% coverage
 - 1 covered by IaC
 - 1 not covered by IaC
 - 1 missing on cloud provider
 - 1/1 changed outside of IaC

Project: my-terraform-project
Region: us-west-2

+ aws_ebs_volume.my_volume
    Type: aws_ebs_volume
    Quantity: 1
    Monthly cost: $10.50

+ aws_instance.my_instance
    Type: aws_instance
    Quantity: 1
    Monthly cost: $100.00

Total monthly cost: $110.50

./pike scan -d .\terraform\
{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Allow",
        "Action": [
            "ec2:MonitorInstances",
            "ec2:UnmonitorInstances",
            "ec2:DescribeInstances",
            "ec2:DescribeTags",
            "ec2:DescribeInstanceAttribute",
            "ec2:DescribeVolumes",
            "ec2:DescribeInstanceTypes",
            "ec2:RunInstances",
            "ec2:DescribeInstanceCreditSpecifications",
            "ec2:StopInstances",
            "ec2:StartInstances",
            "ec2:ModifyInstanceAttribute",
            "ec2:TerminateInstances",
            "ec2:AuthorizeSecurityGroupIngress",
            "ec2:AuthorizeSecurityGroupEgress",
            "ec2:CreateSecurityGroup",
            "ec2:DescribeSecurityGroups",
            "ec2:DescribeAccountAttributes",
            "ec2:DescribeNetworkInterfaces",
            "ec2:DeleteSecurityGroup",
            "ec2:RevokeSecurityGroupEgress"
        ],
        "Resource": "*"
    }
}

content: |-
  Any arbitrary text can be placed anywhere in the content

  {{ .Header }}
  
  and even in between sections
  
  {{ .Providers }}
 
  and they don't even need to be in the default order
  
  {{ .Outputs }}

  include any relative files

  {{ include "relative/path/to/file" }}
 
  {{ .Inputs }}
 
  # Examples

  ```hcl
  {{ include "examples/foo/main.tf" }}

## 管理工具

### [TFSwitch](https://tfswitch.warrensbox.com/)

TFSwitch是一个简单的实用程序，可以帮助管理多个Terraform版本。可以在任何可用的Terraform版本之间切换。如果需要，该工具还将下载需要的版本。当使用多个Terraform代码库时，如果正在处理已弃用或比当前版本更新的代码，这对于避免恼人的语法错误和其他令人头疼的问题至关重要。
要使用TFSwitch，只需要按照下面的说明安装它，然后运行TFSwitch命令来显示所有可用的版本:

```shell
tfswitch
Creating directory for terraform binary at: /home/user/.terraform.versions
Use the arrow keys to navigate: ↓ ↑ → ←
? Select Terraform version:
  ▸ 1.3.9
    1.3.8
    1.3.7
    1.3.6
↓   1.3.5

# Indicate where to source the terraform module from.
# The URL used here is a shorthand for
# "tfr://registry.terraform.io/terraform-aws-modules/vpc/aws?version=3.5.0".
# Note the extra `/` after the protocol is required for the shorthand
# notation.
terraform {
  source = "tfr:///terraform-aws-modules/vpc/aws?version=3.5.0"
}

# Indicate what region to deploy the resources into
generate "provider" {
  path = "provider.tf"
  if_exists = "overwrite_terragrunt"
  contents = <<EOF
provider "aws" {
  region = "us-east-1"
}
EOF
}

# Indicate the input values to use for the variables of the module.
inputs = {
  name = "my-vpc"
  cidr = "10.0.0.0/16"
  azs             = ["us-east-1a", "us-east-1b", "us-east-1c"]
  private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]
  enable_nat_gateway = true
  enable_vpn_gateway = false
  tags = {
    Terraform = "true"
    Environment = "dev"
  }
}