aquasecurity/saas-terraform-connection

Terraform modules for CloudSploit Scanner

CloudSploit Terraform Modules

This Terraform module is responsible for provisioning CloudSploit IAM resources(IAM trust/roles).

This module is considered a Global module and only needs to be provisioned 1 time per AWS Account.

Incorporating this Module

• Add this code to your provider file
• The account_id must be set & passed from the root module.
• The cloudsploit_external_id must be obtained from CloudSploit and different AWS accounts have different external IDs.
• The use_aws_gov can be set to a boolean value, it defaults to false

module "cloudsploit" {
  source                  = "[email protected]:cloudsploit/cloudsploit-terraform-scans.git"
  account_id              = "${var.account_id}"
  cloudsploit_external_id = "${var.cloudsploit_external_id}"
}

Outputs

• cloudsploit_cross_account_role_arn - Cloudsploit cross account trust role. This is only output if use_aws_gov is set to false.
• cloudsploit_cross_account_role_arn-gov - Cloudsploit cross account trust role for AWS gov. This is only output if use_aws_gov is set to true.

saas-terraform-connection's Issues

duplicate values

Error: aws_iam_role.cloudsploit_cross_account_role: resource repeated multiple times



Error: aws_iam_role_policy_attachment.cloudsploit_cross_account_attach: resource repeated multiple times

account_id never used

The account_id variable is never used, can be removed?

Help Guide people to the correct branch, version, etc

I have noticed (and even raised one myself) several PRs which are opened targeting solving problems in a post terraform 0.12 world where we can have almost nice things. Even as a user of this module I had forgot that I should use https://github.com/cloudsploit/cloudsploit-terraform-scans/tree/terraform-v0.12 rather than master when I popped back later. I also referred someone here and they said their setup is not working without grabbing one of the existing forks or making one yourself. I think if we are to have some non standard development strategy where master does not represent latest then I think its important that we call this out in the repository README.md.

Looking at this (at the time of writing this): https://github.com/cloudsploit/cloudsploit-terraform-scans/compare/terraform-v0.12

The following PRs can be closed:

• #11 (can be closed)
• #9 (can be closed but has IMO a slightly better solution than the one merged)
• #8 (can be closed)

I am happy to submit a PR to both branches if I know what the plans are here.

Fails to retrieve module from GitHub

I'm trying to set up a new connection between CloudSploit and my AWS account using Terraform. I was directed to use this module from the Connect a New Account wizard. I have configured var.account_id and var.cloudsploit_external_id but left the source URL as-is from the example here.

module "cloudsploit" {
  source                  = "[email protected]:cloudsploit/cloudsploit-terraform-scans.git"
  account_id              = "${var.account_id}"
  cloudsploit_external_id = "${var.cloudsploit_external_id}"
}

When I attempt to run terraform get I am first prompted with an SSH server key verification prompt, and after passing that prompt I receive an error about failing to clone the repository.

NICWALLER-MBP-1:stack nic.waller$ terraform get
- module.cloudsploit
  Getting source "[email protected]:cloudsploit/cloudsploit-terraform-scans.git"
The authenticity of host 'github.com (192.30.255.113)' can't be established.
RSA key fingerprint is SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8.
Are you sure you want to continue connecting (yes/no)? yes
Error loading modules: error downloading 'ssh://[email protected]/cloudsploit/cloudsploit-terraform-scans.git': /usr/bin/git exited with 128: Cloning into '.terraform/modules/fe20c829940862d512e6142d2edffa62'...
Warning: Permanently added 'github.com,192.30.255.113' (RSA) to the list of known hosts.
[email protected]: Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

NICWALLER-MBP-1:stack nic.waller$ 

I am able to clone the repository without problem when I use git clone in my shell.

Workaround

I'm also able to use terraform get without error when I change the syntax for the source module to the following:

  source                  = "github.com/cloudsploit/cloudsploit-terraform-scans"

Additional Details

• Terraform v0.11.14
• macOS 10.15.2
• git version 2.16.2

Roles missing [count.index] while your using count

Line 32 in both your Role deployments are missing [count.index] when you have count set..

I'll make a PR to merge my changes