generated from terraform-linters/tflint-ruleset-template
-
Notifications
You must be signed in to change notification settings - Fork 74
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add acm certificate lifecycle create before destroy rule (#202)
* Add acm certificate lifecycle create before destroy rule * Fix broken links
- Loading branch information
Showing
6 changed files
with
188 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| # aws_acm_certificate_lifecycle | ||
|
|
||
| This rule ensures lifecycle [`create_before_destroy`](https://www.terraform.io/docs/language/meta-arguments/lifecycle.html#create_before_destroy) | ||
| argument is set to `true` for acm certificates as per | ||
| [`aws_acm_certificate`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/acm_certificate) | ||
| official docs: | ||
|
|
||
| > It's recommended to specify `create_before_destroy = true` in a | ||
| > lifecycle block to replace a certificate which is currently in use | ||
|
|
||
| ## Example | ||
|
|
||
| ```hcl | ||
| resource "aws_acm_certificate" "test" { | ||
| domain_name = var.domain_name | ||
| validation_method = "DNS" | ||
| } | ||
| ``` | ||
|
|
||
| ```console | ||
| $ tflint | ||
| 1 issue(s) found: | ||
|
|
||
| Warning: resource `aws_acm_certificate` needs to contain `create_before_destroy = true` in `lifecycle` block (aws_acm_certificate_lifecycle) | ||
|
|
||
| on test.tf line 1: | ||
| 1: resource "aws_acm_certificate" "test" { | ||
| ``` | ||
|
|
||
| ## Why | ||
|
|
||
| If you don't add this, terraform will timeout when trying to replace a certificate | ||
| that's in use at the moment of apply. | ||
|
|
||
| ## How To Fix | ||
|
|
||
| ```hcl | ||
| resource "aws_acm_certificate" "test" { | ||
| domain_name = local.assets_domain_name | ||
| validation_method = "DNS" | ||
| lifecycle { | ||
| create_before_destroy = true | ||
| } | ||
| } | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| package rules | ||
|
|
||
| import ( | ||
| "github.com/terraform-linters/tflint-plugin-sdk/terraform/configs" | ||
| "github.com/terraform-linters/tflint-plugin-sdk/tflint" | ||
| "github.com/terraform-linters/tflint-ruleset-aws/project" | ||
| ) | ||
|
|
||
| // AwsAcmCertificateLifecycleRule checks whether `create_before_destroy = true` is set in a lifecycle block of | ||
| // `aws_acm_certificate` resource | ||
| type AwsAcmCertificateLifecycleRule struct { | ||
| resourceType string | ||
| attributeName string | ||
| } | ||
|
|
||
| // NewAwsAcmCertificateLifecycleRule returns new rule with default attributes | ||
| func NewAwsAcmCertificateLifecycleRule() *AwsAcmCertificateLifecycleRule { | ||
| return &AwsAcmCertificateLifecycleRule{ | ||
| resourceType: "aws_acm_certificate", | ||
| attributeName: "lifecycle", | ||
| } | ||
| } | ||
|
|
||
| // Name returns the rule name | ||
| func (r *AwsAcmCertificateLifecycleRule) Name() string { | ||
| return "aws_acm_certificate_lifecycle" | ||
| } | ||
|
|
||
| // Enabled returns whether the rule is enabled by default | ||
| func (r *AwsAcmCertificateLifecycleRule) Enabled() bool { | ||
| return true | ||
| } | ||
|
|
||
| // Severity returns the rule severity | ||
| func (r *AwsAcmCertificateLifecycleRule) Severity() string { | ||
| return tflint.WARNING | ||
| } | ||
|
|
||
| // Link returns the rule reference link | ||
| func (r *AwsAcmCertificateLifecycleRule) Link() string { | ||
| return project.ReferenceLink(r.Name()) | ||
| } | ||
|
|
||
| // Check checks whether the aws_acm_certificate resource contains create_before_destroy = true in lifecycle block | ||
| func (r *AwsAcmCertificateLifecycleRule) Check(runner tflint.Runner) error { | ||
| return runner.WalkResources("aws_acm_certificate", func(resource *configs.Resource) error { | ||
| if !resource.Managed.CreateBeforeDestroy { | ||
| if err := runner.EmitIssue(r, "resource `aws_acm_certificate` needs to contain `create_before_destroy = true` in `lifecycle` block", resource.DeclRange); err != nil { | ||
| return err | ||
| } | ||
| } | ||
| return nil | ||
| }) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,80 @@ | ||
| package rules | ||
|
|
||
| import ( | ||
| "testing" | ||
|
|
||
| hcl "github.com/hashicorp/hcl/v2" | ||
| "github.com/terraform-linters/tflint-plugin-sdk/helper" | ||
| ) | ||
|
|
||
| func Test_AwsAcmCertificateLifecycle(t *testing.T) { | ||
| cases := []struct { | ||
| Name string | ||
| Content string | ||
| Expected helper.Issues | ||
| }{ | ||
| { | ||
| Name: "no lifecycle block", | ||
| Content: ` | ||
| resource "aws_acm_certificate" "test" { | ||
| domain_name = var.domain_name | ||
| validation_method = "DNS" | ||
| }`, | ||
| Expected: helper.Issues{ | ||
| { | ||
| Rule: NewAwsAcmCertificateLifecycleRule(), | ||
| Message: "resource `aws_acm_certificate` needs to contain `create_before_destroy = true` in `lifecycle` block", | ||
| Range: hcl.Range{ | ||
| Filename: "resource.tf", | ||
| Start: hcl.Pos{Line: 2, Column: 1}, | ||
| End: hcl.Pos{Line: 2, Column: 38}, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| { | ||
| Name: "no create_before_destroy attribute in lifecycle block", | ||
| Content: ` | ||
| resource "aws_acm_certificate" "test" { | ||
| domain_name = var.domain_name | ||
| validation_method = "DNS" | ||
| lifecycle {} | ||
| }`, | ||
| Expected: helper.Issues{ | ||
| { | ||
| Rule: NewAwsAcmCertificateLifecycleRule(), | ||
| Message: "resource `aws_acm_certificate` needs to contain `create_before_destroy = true` in `lifecycle` block", | ||
| Range: hcl.Range{ | ||
| Filename: "resource.tf", | ||
| Start: hcl.Pos{Line: 2, Column: 1}, | ||
| End: hcl.Pos{Line: 2, Column: 38}, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| { | ||
| Name: "create_before_destroy = false", | ||
| Content: ` | ||
| resource "aws_acm_certificate" "test" { | ||
| domain_name = var.domain_name | ||
| validation_method = "DNS" | ||
| lifecycle { | ||
| create_before_destroy = true | ||
| } | ||
| }`, | ||
| Expected: helper.Issues{}, | ||
| }, | ||
| } | ||
|
|
||
| rule := NewAwsAcmCertificateLifecycleRule() | ||
|
|
||
| for _, tc := range cases { | ||
| runner := helper.TestRunner(t, map[string]string{"resource.tf": tc.Content}) | ||
|
|
||
| if err := rule.Check(runner); err != nil { | ||
| t.Fatalf("Unexpected error occurred: %s", err) | ||
| } | ||
|
|
||
| helper.AssertIssues(t, tc.Expected, runner.Issues) | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters