Skip to content

Commit a10e60a

Browse files
PatMyronPatMyron
authored
mapping aws_acmpca_certificate and aws_acmpca_certificate_authority_certificate (#218)
* mapping aws_acmpca_certificate and aws_acmpca_certificate_authority_certificate https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/acmpca_certificate https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/acmpca_certificate_authority_certificate https://github.com/aws/aws-sdk-go/blob/main/models/apis/acm-pca/2017-08-22/api-2.json * hcl formatting * go generate https://stackoverflow.com/questions/3796927/how-to-git-clone-including-submodules
1 parent 58e127b commit a10e60a

6 files changed

+273
-0
lines changed

‎docs/rules/README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,10 @@ These rules enforce best practices and naming conventions:
7171
|aws_acm_certificate_invalid_certificate_body|✔|
7272
|aws_acm_certificate_invalid_certificate_chain|✔|
7373
|aws_acm_certificate_invalid_private_key|✔|
74+
|aws_acmpca_certificate_authority_certificate_invalid_certificate_authority_arn|✔|
7475
|aws_acmpca_certificate_authority_invalid_type|✔|
76+
|aws_acmpca_certificate_invalid_certificate_authority_arn|✔|
77+
|aws_acmpca_certificate_invalid_signing_algorithm|✔|
7578
|aws_alb_invalid_ip_address_type|✔|
7679
|aws_alb_invalid_load_balancer_type|✔|
7780
|aws_alb_listener_invalid_protocol|✔|

‎rules/models/aws_acmpca_certificate_authority_certificate_invalid_certificate_authority_arn.go

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
// This file generated by `generator/`. DO NOT EDIT
2+
3+
package models
4+
5+
import (
6+
"fmt"
7+
"log"
8+
"regexp"
9+
10+
hcl "github.com/hashicorp/hcl/v2"
11+
"github.com/terraform-linters/tflint-plugin-sdk/tflint"
12+
)
13+
14+
// AwsAcmpcaCertificateAuthorityCertificateInvalidCertificateAuthorityArnRule checks the pattern is valid
15+
type AwsAcmpcaCertificateAuthorityCertificateInvalidCertificateAuthorityArnRule struct {
16+
resourceType string
17+
attributeName string
18+
max int
19+
min int
20+
pattern *regexp.Regexp
21+
}
22+
23+
// NewAwsAcmpcaCertificateAuthorityCertificateInvalidCertificateAuthorityArnRule returns new rule with default attributes
24+
func NewAwsAcmpcaCertificateAuthorityCertificateInvalidCertificateAuthorityArnRule() *AwsAcmpcaCertificateAuthorityCertificateInvalidCertificateAuthorityArnRule {
25+
return &AwsAcmpcaCertificateAuthorityCertificateInvalidCertificateAuthorityArnRule{
26+
resourceType: "aws_acmpca_certificate_authority_certificate",
27+
attributeName: "certificate_authority_arn",
28+
max: 200,
29+
min: 5,
30+
pattern: regexp.MustCompile(`^arn:[\w+=/,.@-]+:[\w+=/,.@-]+:[\w+=/,.@-]*:[0-9]*:[\w+=,.@-]+(/[\w+=,.@-]+)*$`),
31+
}
32+
}
33+
34+
// Name returns the rule name
35+
func (r *AwsAcmpcaCertificateAuthorityCertificateInvalidCertificateAuthorityArnRule) Name() string {
36+
return "aws_acmpca_certificate_authority_certificate_invalid_certificate_authority_arn"
37+
}
38+
39+
// Enabled returns whether the rule is enabled by default
40+
func (r *AwsAcmpcaCertificateAuthorityCertificateInvalidCertificateAuthorityArnRule) Enabled() bool {
41+
return true
42+
}
43+
44+
// Severity returns the rule severity
45+
func (r *AwsAcmpcaCertificateAuthorityCertificateInvalidCertificateAuthorityArnRule) Severity() string {
46+
return tflint.ERROR
47+
}
48+
49+
// Link returns the rule reference link
50+
func (r *AwsAcmpcaCertificateAuthorityCertificateInvalidCertificateAuthorityArnRule) Link() string {
51+
return ""
52+
}
53+
54+
// Check checks the pattern is valid
55+
func (r *AwsAcmpcaCertificateAuthorityCertificateInvalidCertificateAuthorityArnRule) Check(runner tflint.Runner) error {
56+
log.Printf("[TRACE] Check `%s` rule", r.Name())
57+
58+
return runner.WalkResourceAttributes(r.resourceType, r.attributeName, func(attribute *hcl.Attribute) error {
59+
var val string
60+
err := runner.EvaluateExpr(attribute.Expr, &val, nil)
61+
62+
return runner.EnsureNoError(err, func() error {
63+
if len(val) > r.max {
64+
runner.EmitIssueOnExpr(
65+
r,
66+
"certificate_authority_arn must be 200 characters or less",
67+
attribute.Expr,
68+
)
69+
}
70+
if len(val) < r.min {
71+
runner.EmitIssueOnExpr(
72+
r,
73+
"certificate_authority_arn must be 5 characters or higher",
74+
attribute.Expr,
75+
)
76+
}
77+
if !r.pattern.MatchString(val) {
78+
runner.EmitIssueOnExpr(
79+
r,
80+
fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^arn:[\w+=/,.@-]+:[\w+=/,.@-]+:[\w+=/,.@-]*:[0-9]*:[\w+=,.@-]+(/[\w+=,.@-]+)*$`),
81+
attribute.Expr,
82+
)
83+
}
84+
return nil
85+
})
86+
})
87+
}

‎rules/models/aws_acmpca_certificate_invalid_certificate_authority_arn.go

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
// This file generated by `generator/`. DO NOT EDIT
2+
3+
package models
4+
5+
import (
6+
"fmt"
7+
"log"
8+
"regexp"
9+
10+
hcl "github.com/hashicorp/hcl/v2"
11+
"github.com/terraform-linters/tflint-plugin-sdk/tflint"
12+
)
13+
14+
// AwsAcmpcaCertificateInvalidCertificateAuthorityArnRule checks the pattern is valid
15+
type AwsAcmpcaCertificateInvalidCertificateAuthorityArnRule struct {
16+
resourceType string
17+
attributeName string
18+
max int
19+
min int
20+
pattern *regexp.Regexp
21+
}
22+
23+
// NewAwsAcmpcaCertificateInvalidCertificateAuthorityArnRule returns new rule with default attributes
24+
func NewAwsAcmpcaCertificateInvalidCertificateAuthorityArnRule() *AwsAcmpcaCertificateInvalidCertificateAuthorityArnRule {
25+
return &AwsAcmpcaCertificateInvalidCertificateAuthorityArnRule{
26+
resourceType: "aws_acmpca_certificate",
27+
attributeName: "certificate_authority_arn",
28+
max: 200,
29+
min: 5,
30+
pattern: regexp.MustCompile(`^arn:[\w+=/,.@-]+:[\w+=/,.@-]+:[\w+=/,.@-]*:[0-9]*:[\w+=,.@-]+(/[\w+=,.@-]+)*$`),
31+
}
32+
}
33+
34+
// Name returns the rule name
35+
func (r *AwsAcmpcaCertificateInvalidCertificateAuthorityArnRule) Name() string {
36+
return "aws_acmpca_certificate_invalid_certificate_authority_arn"
37+
}
38+
39+
// Enabled returns whether the rule is enabled by default
40+
func (r *AwsAcmpcaCertificateInvalidCertificateAuthorityArnRule) Enabled() bool {
41+
return true
42+
}
43+
44+
// Severity returns the rule severity
45+
func (r *AwsAcmpcaCertificateInvalidCertificateAuthorityArnRule) Severity() string {
46+
return tflint.ERROR
47+
}
48+
49+
// Link returns the rule reference link
50+
func (r *AwsAcmpcaCertificateInvalidCertificateAuthorityArnRule) Link() string {
51+
return ""
52+
}
53+
54+
// Check checks the pattern is valid
55+
func (r *AwsAcmpcaCertificateInvalidCertificateAuthorityArnRule) Check(runner tflint.Runner) error {
56+
log.Printf("[TRACE] Check `%s` rule", r.Name())
57+
58+
return runner.WalkResourceAttributes(r.resourceType, r.attributeName, func(attribute *hcl.Attribute) error {
59+
var val string
60+
err := runner.EvaluateExpr(attribute.Expr, &val, nil)
61+
62+
return runner.EnsureNoError(err, func() error {
63+
if len(val) > r.max {
64+
runner.EmitIssueOnExpr(
65+
r,
66+
"certificate_authority_arn must be 200 characters or less",
67+
attribute.Expr,
68+
)
69+
}
70+
if len(val) < r.min {
71+
runner.EmitIssueOnExpr(
72+
r,
73+
"certificate_authority_arn must be 5 characters or higher",
74+
attribute.Expr,
75+
)
76+
}
77+
if !r.pattern.MatchString(val) {
78+
runner.EmitIssueOnExpr(
79+
r,
80+
fmt.Sprintf(`"%s" does not match valid pattern %s`, truncateLongMessage(val), `^arn:[\w+=/,.@-]+:[\w+=/,.@-]+:[\w+=/,.@-]*:[0-9]*:[\w+=,.@-]+(/[\w+=,.@-]+)*$`),
81+
attribute.Expr,
82+
)
83+
}
84+
return nil
85+
})
86+
})
87+
}

‎rules/models/aws_acmpca_certificate_invalid_signing_algorithm.go

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
// This file generated by `generator/`. DO NOT EDIT
2+
3+
package models
4+
5+
import (
6+
"fmt"
7+
"log"
8+
9+
hcl "github.com/hashicorp/hcl/v2"
10+
"github.com/terraform-linters/tflint-plugin-sdk/tflint"
11+
)
12+
13+
// AwsAcmpcaCertificateInvalidSigningAlgorithmRule checks the pattern is valid
14+
type AwsAcmpcaCertificateInvalidSigningAlgorithmRule struct {
15+
resourceType string
16+
attributeName string
17+
enum []string
18+
}
19+
20+
// NewAwsAcmpcaCertificateInvalidSigningAlgorithmRule returns new rule with default attributes
21+
func NewAwsAcmpcaCertificateInvalidSigningAlgorithmRule() *AwsAcmpcaCertificateInvalidSigningAlgorithmRule {
22+
return &AwsAcmpcaCertificateInvalidSigningAlgorithmRule{
23+
resourceType: "aws_acmpca_certificate",
24+
attributeName: "signing_algorithm",
25+
enum: []string{
26+
"SHA256WITHECDSA",
27+
"SHA384WITHECDSA",
28+
"SHA512WITHECDSA",
29+
"SHA256WITHRSA",
30+
"SHA384WITHRSA",
31+
"SHA512WITHRSA",
32+
},
33+
}
34+
}
35+
36+
// Name returns the rule name
37+
func (r *AwsAcmpcaCertificateInvalidSigningAlgorithmRule) Name() string {
38+
return "aws_acmpca_certificate_invalid_signing_algorithm"
39+
}
40+
41+
// Enabled returns whether the rule is enabled by default
42+
func (r *AwsAcmpcaCertificateInvalidSigningAlgorithmRule) Enabled() bool {
43+
return true
44+
}
45+
46+
// Severity returns the rule severity
47+
func (r *AwsAcmpcaCertificateInvalidSigningAlgorithmRule) Severity() string {
48+
return tflint.ERROR
49+
}
50+
51+
// Link returns the rule reference link
52+
func (r *AwsAcmpcaCertificateInvalidSigningAlgorithmRule) Link() string {
53+
return ""
54+
}
55+
56+
// Check checks the pattern is valid
57+
func (r *AwsAcmpcaCertificateInvalidSigningAlgorithmRule) Check(runner tflint.Runner) error {
58+
log.Printf("[TRACE] Check `%s` rule", r.Name())
59+
60+
return runner.WalkResourceAttributes(r.resourceType, r.attributeName, func(attribute *hcl.Attribute) error {
61+
var val string
62+
err := runner.EvaluateExpr(attribute.Expr, &val, nil)
63+
64+
return runner.EnsureNoError(err, func() error {
65+
found := false
66+
for _, item := range r.enum {
67+
if item == val {
68+
found = true
69+
}
70+
}
71+
if !found {
72+
runner.EmitIssueOnExpr(
73+
r,
74+
fmt.Sprintf(`"%s" is an invalid value as signing_algorithm`, truncateLongMessage(val)),
75+
attribute.Expr,
76+
)
77+
}
78+
return nil
79+
})
80+
})
81+
}

‎rules/models/mappings/acm-pca.hcl

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,21 @@
11
import = "aws-sdk-go/models/apis/acm-pca/2017-08-22/api-2.json"
22

3+
mapping "aws_acmpca_certificate" {
4+
certificate_authority_arn = Arn
5+
certificate_signing_request = CsrBlob
6+
signing_algorithm = SigningAlgorithm
7+
}
8+
39
mapping "aws_acmpca_certificate_authority" {
410
type = CertificateAuthorityType
511
}
612

13+
mapping "aws_acmpca_certificate_authority_certificate" {
14+
certificate_authority_arn = Arn
15+
certificate = CertificateBodyBlob
16+
certificate_chain = CertificateChainBlob
17+
}
18+
719
test "aws_acmpca_certificate_authority" "type" {
820
ok = "SUBORDINATE"
921
ng = "ORDINATE"

‎rules/models/provider.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,10 @@ var Rules = []tflint.Rule{
99
NewAwsAcmCertificateInvalidCertificateBodyRule(),
1010
NewAwsAcmCertificateInvalidCertificateChainRule(),
1111
NewAwsAcmCertificateInvalidPrivateKeyRule(),
12+
NewAwsAcmpcaCertificateAuthorityCertificateInvalidCertificateAuthorityArnRule(),
1213
NewAwsAcmpcaCertificateAuthorityInvalidTypeRule(),
14+
NewAwsAcmpcaCertificateInvalidCertificateAuthorityArnRule(),
15+
NewAwsAcmpcaCertificateInvalidSigningAlgorithmRule(),
1316
NewAwsALBInvalidIPAddressTypeRule(),
1417
NewAwsALBInvalidLoadBalancerTypeRule(),
1518
NewAwsALBListenerInvalidProtocolRule(),

0 commit comments

Comments
 (0)