init commit

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @sulaiman-coder

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  # Maintain dependencies for go-modules
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: "monthly"

.github/workflows/bypass-cla.yml

@@ -0,0 +1,12 @@
+# This workflow is used to bypass the required status checks in merge queue.
+# cf. https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/troubleshooting-required-status-checks
+name: CLA
+on:
+  merge_group:
+
+jobs:
+  cla:
+    name: license/cla
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No test required"'

.github/workflows/lint.yml

@@ -0,0 +1,32 @@
+name: golangci-lint
+
+on:
+  push:
+    tags:
+      - v*
+    branches:
+      - master
+      - main
+  pull_request:
+  merge_group:
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  golangci:
+    name: lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v4
+        with:
+          go-version-file: go.mod
+          cache: true
+          cache-dependency-path: go.sum
+      - uses: golangci/golangci-lint-action@v3
+        with:
+          version: v1.54
+          skip-cache: true
+          args: --timeout 10m --verbose

.github/workflows/stale.yml

@@ -0,0 +1,26 @@
+name: 'Close stale issues and PRs'
+
+on:
+  schedule:
+    - cron: '0 15 * * *'
+
+permissions:
+  issues: write
+  pull-requests: write
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@v8
+        with:
+          stale-issue-message: 'This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.'
+          stale-pr-message: 'This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 10 days.'
+          close-issue-message: 'This issue was closed because it has been stalled for 7 days with no activity.'
+          close-pr-message: 'This PR was closed because it has been stalled for 7 days with no activity.'
+          days-before-issue-stale: 30
+          days-before-pr-stale: 30
+          days-before-issue-close: 365
+          days-before-pr-close: 365
+          stale-issue-label: stale 
+          stale-pr-label: stale

.github/workflows/test-go.yml

@@ -0,0 +1,39 @@
+name: test go
+
+on:
+  pull_request:
+  merge_group:
+  schedule:
+  - cron:  0 23 * * *
+
+jobs:
+  build:
+    name: building defsec
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ macos-latest, windows-latest, ubuntu-latest ]
+
+    steps:
+    - uses: actions/checkout@v4
+
+    - uses: actions/setup-go@v4
+      if: matrix.os != 'windows-latest'
+      with:
+        go-version-file: go.mod
+        cache: true
+        cache-dependency-path: go.sum
+    - uses: actions/setup-go@v4
+      if: matrix.os == 'windows-latest'
+      with:
+        go-version-file: go.mod
+        cache: false
+
+    - name: Run non-localstack tests
+      if: matrix.os != 'ubuntu-latest'
+      run: make test-no-localstack
+      shell: bash
+    - name: Run full tests
+      if: matrix.os == 'ubuntu-latest'
+      run: make test
+      shell: bash

.gitignore

@@ -0,0 +1,12 @@
+# Test binary, built with `go test -c`
+*.test
+
+# Output of the go coverage tool, specifically when used with LiteIDE
+*.out
+
+# Dependency directories (remove the comment below to include it)
+vendor/
+.idea/
+*.iml
+.vscode/
+.DS_Store

.golangci.yml

@@ -0,0 +1,35 @@
+linters:
+  disable-all: true
+  enable:
+    - errcheck
+    - gosimple
+    - govet
+    - ineffassign
+    - staticcheck
+    - unused
+    - bodyclose
+    - cyclop
+    - durationcheck
+    - errname
+    - errorlint
+    - exportloopref
+    - goimports
+    - gocritic
+    - gosec
+
+linters-settings:
+  cyclop:
+    max-complexity: 18
+  gocritic:
+    disabled-checks:
+      - singleCaseSwitch
+  staticcheck:
+    checks:
+      - all
+      - '-SA1019' # TODO
+
+issues:
+  exclude-rules:
+    - path: "."
+      linters:
+        - typecheck

ARCHITECTURE.md

@@ -0,0 +1,15 @@
+# Architecture
+
+This document aims to answer the question *Where is the code that does X?*
+
+## Project Layout
+
+The directory structure is broken down as follows:
+
+- `internal/adapters` - Adapters take input - such as a Terraform file or an AWS account - and _adapt_ it to a common format that can be used by the rules engine. This is where the bulk of the code is for supporting new cloud providers.
+- `pkg/scanners` - Scanners for various inputs. For example, the `terraform` scanner will scan a Terraform directory and return a list of resources.
+- `pkg/state` - The overall state object for Cloud providers is defined here. You should add to the `State` struct if you want to add a new cloud provider.
+- `pkg/terraform` - Data structures for describing Terraform resources and modules.
+- `pkg/types` - Useful types. Our types wrap a simple data type (e.g. `bool`) and add various metadata to it, such as file name and line number where it was defined.
+- `pkg/concurrency` - Data structures used to concurrently adapt resources
+- `test` - Integration tests and other high-level tests that require a full build of the project.

CODE_OF_CONDUCT.md

@@ -0,0 +1,5 @@
+# Code of Conduct
+
+KhulnaSoft Security open source projects follow the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md).
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to a project maintainer.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 KhulnaSoft Ltd.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

Makefile

@@ -0,0 +1,17 @@
+.PHONY: test
+test:
+	go test -race ./...
+
+.PHONY: test-no-localstack
+test-no-localstack:
+	go test $$(go list ./... | grep -v internal/adapters | awk -F'github.com/khulnasoft/tunnel-aws' '{print "./"$$2}')
+
+.PHONY: quality
+quality:
+	which golangci-lint || go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.52.2
+	golangci-lint run --timeout 5m --verbose
+
+.PHONY: update-aws-deps
+update-aws-deps:
+	@grep aws-sdk-go-v2 go.mod | grep -v '// indirect' | sed 's/^[\t\s]*//g' | sed 's/\s.*//g' | xargs go get
+	@go mod tidy

README.md

@@ -0,0 +1,9 @@
+# tunnel-aws
+
+_tunnel-aws_ is the AWS misconfiguration scanning logic for Tunnel
+
+Please see [ARCHITECTURE.md](ARCHITECTURE.md) for more information.
+
+_tunnel-aws_ is an [KhulnaSoft Security](https://khulnasoft.com) open source project.
+Learn about our open source work and portfolio [here](https://www.khulnasoft.com/products/open-source-projects/).
+Join the community, and talk to us about any matter in [GitHub Discussion](https://github.com/khulnasoft/tunnel/discussions).