IaC-র পরীক্ষা — plan review, policy as code আর নিরাপত্তা scan

$ terraform fmt -check -diff
main.tf
--- old/main.tf
+++ new/main.tf
@@ -8,8 +8,8 @@
 }

 resource "local_file" "banner" {
-  filename="banner.txt"
-    content = "welcome"
+  filename  = "banner.txt"
+  content   = "welcome"
   file_mode = "0640"
-  owner = "deploy"
+  owner     = "deploy"
 }
$ echo $?
3

$ terraform validate

Error: Unsupported argument

  on main.tf line 13, in resource "local_file" "banner":
  13:   file_mode = "0640"

An argument named "file_mode" is not expected here.

Error: Unsupported argument

  on main.tf line 14, in resource "local_file" "banner":
  14:   owner = "deploy"

An argument named "owner" is not expected here.
$ echo $?
1

$ checkov -f plan.json --framework terraform_plan --compact
Passed checks: 7, Failed checks: 1, Skipped checks: 0

Check: CKV_AWS_20: "S3 Bucket has an ACL defined which allows public READ access."
    FAILED for resource: aws_s3_bucket.assets

$ trivy config --severity HIGH,CRITICAL .
main.tf (terraform)

Tests: 12 (SUCCESSES: 11, FAILURES: 1)
Failures: 1 (HIGH: 1, CRITICAL: 0)

AVD-AWS-0086 (HIGH): No public access block so not blocking public acls

variable "env" {
  type    = string
  default = "dev"
}

variable "replicas" {
  type    = number
  default = 2

  validation {
    condition     = var.replicas >= 1 && var.replicas <= 6
    error_message = "replicas must be between 1 and 6."
  }
}

# Data source with a postcondition: the namespace must carry a team label.
data "kubernetes_namespace_v1" "target" {
  metadata {
    name = "abcl-tp"
  }

  lifecycle {
    postcondition {
      condition     = can(self.metadata[0].labels["team"])
      error_message = "Namespace needs a team label."
    }
  }
}

resource "local_file" "app_config" {
  filename = "${path.module}/app.conf"
  content  = "env=${var.env}\nreplicas=${var.replicas}\n"

  lifecycle {
    precondition {
      condition     = var.env != "prod" || var.replicas >= 2
      error_message = "prod needs at least 2 replicas."
    }
  }
}

# check block: a failed assert only warns, it never stops the run.
check "namespace_has_quota" {
  data "kubernetes_resources" "quotas" {
    api_version = "v1"
    kind        = "ResourceQuota"
    namespace   = "abcl-tp"
  }

  assert {
    condition     = length(data.kubernetes_resources.quotas.objects) > 0
    error_message = "Namespace abcl-tp has no ResourceQuota."
  }
}

$ terraform plan -var replicas=9
…
Error: Invalid value for variable

  on main.tf line 24:
  24: variable "replicas" {
    ├────────────────
    │ var.replicas is 9

replicas must be between 1 and 6.

This was checked by the validation rule at main.tf:28,3-13.

$ terraform plan -var env=prod -var replicas=1
…
Error: Resource precondition failed

  on main.tf line 54, in resource "local_file" "app_config":
  54:       condition     = var.env != "prod" || var.replicas >= 2
    ├────────────────
    │ var.env is "prod"
    │ var.replicas is 1

prod needs at least 2 replicas.

$ terraform plan       # namespace-এ team label নেই
…
Error: Resource postcondition failed

  on main.tf line 42, in data "kubernetes_namespace_v1" "target":
  42:       condition     = can(self.metadata[0].labels["team"])
    ├────────────────
    │ self.metadata[0].labels is map of string with 1 element

Namespace needs a team label.

$ terraform apply -auto-approve -var env=prod -var replicas=2
…
Warning: Check block assertion failed

  on main.tf line 69, in check "namespace_has_quota":
  69:     condition     = length(data.kubernetes_resources.quotas.objects) > 0
    ├────────────────
    │ data.kubernetes_resources.quotas.objects is empty tuple

Namespace abcl-tp has no ResourceQuota.

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
$ echo $?
0

$ terraform apply -auto-approve
…
kubernetes_service_v1.api: Creating...
kubernetes_service_v1.api: Creation complete after 0s [id=abcl-tp/pc-api]

Error: Resource postcondition failed

  on main.tf line 28, in resource "kubernetes_service_v1" "api":
  28:       condition     = startswith(self.spec[0].cluster_ip, "192.168.")
    ├────────────────
    │ self.spec[0].cluster_ip is "10.110.80.18"

Service IP is outside the expected range.
$ terraform state list
kubernetes_service_v1.api

locals {
  # Rule: prod always runs at least 2 copies.
  replicas = var.env == "prod" ? min(var.replicas, 2) : var.replicas
}

# Unit test: a fake kubernetes provider, so no cluster is needed.
mock_provider "kubernetes" {}

variables {
  name = "bazar-api"
}

run "dev_keeps_one_replica" {
  command = plan

  assert {
    condition     = output.replicas == 1
    error_message = "dev should keep 1 replica."
  }
}

run "prod_runs_at_least_two" {
  command = plan

  variables {
    env      = "prod"
    replicas = 1
  }

  assert {
    condition     = output.replicas >= 2
    error_message = "prod must run at least 2 replicas."
  }
}

run "too_many_replicas_rejected" {
  command = plan

  variables {
    replicas = 9
  }

  expect_failures = [var.replicas]
}

$ terraform test
tests\unit.tftest.hcl... in progress
  run "dev_keeps_one_replica"... pass
  run "prod_runs_at_least_two"... fail

Error: Test assertion failed

  on tests\unit.tftest.hcl line 26, in run "prod_runs_at_least_two":
  26:     condition     = output.replicas >= 2
    ├────────────────
    │ Diff:
    │ --- actual
    │ +++ expected
    │ - 1
    │ + 2


prod must run at least 2 replicas.
  run "too_many_replicas_rejected"... pass
tests\unit.tftest.hcl... tearing down
tests\unit.tftest.hcl... fail

Failure! 2 passed, 1 failed.
$ echo $?
1

# Integration test: real provider, real Deployment, destroyed afterwards.
provider "kubernetes" {
  config_context = "docker-desktop"
}

run "real_rollout_in_scratch_namespace" {
  command = apply

  variables {
    name     = "tp-itest"
    env      = "prod"
    replicas = 2
  }

  assert {
    condition     = kubernetes_deployment_v1.app.spec[0].replicas == "2"
    error_message = "The Deployment should ask for 2 replicas."
  }
}

$ terraform test -filter='tests\integration.tftest.hcl'
tests\integration.tftest.hcl... in progress
  run "real_rollout_in_scratch_namespace"... pass
tests\integration.tftest.hcl... tearing down
tests\integration.tftest.hcl... pass

Success! 1 passed, 0 failed.
$ kubectl get deploy -n abcl-tp
No resources found in abcl-tp namespace.

$ terraform plan -out=bad.tfplan -var replicas=8 \
    -var 'labels={app="bazar"}' -var service_type=LoadBalancer
…
Saved the plan to: bad.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "bad.tfplan"
$ terraform show -json bad.tfplan > bad.json

{
  "format_version": "1.2",
  "terraform_version": "1.17.1",
  "resource_changes": [
    {
      "address": "kubernetes_deployment_v1.api",
      "type": "kubernetes_deployment_v1",
      "change": {
        "actions": ["create"],
        "before": null,
        "after": {
          "metadata": [{ "labels": { "app": "bazar" }, "name": "bazar-api" }],
          "spec": [{ "replicas": "8" }]
        }
      }
    }
  ]
}

#!/usr/bin/env python3
"""Deny risky changes in a Terraform plan. Usage: policy.py plan.json"""
import json
import sys

MAX_REPLICAS = 6
REQUIRED_LABELS = {"app", "owner"}

plan = json.load(open(sys.argv[1], encoding="utf-8"))
denies = []
for rc in plan.get("resource_changes", []):
    actions, after = rc["change"]["actions"], rc["change"]["after"] or {}
    if actions in (["no-op"], ["read"], ["delete"]):
        continue
    if rc["type"] == "kubernetes_deployment_v1":
        labels = after["metadata"][0].get("labels") or {}
        missing = sorted(REQUIRED_LABELS - set(labels))
        if missing:
            denies.append(f"{rc['address']}: missing labels {missing}")
        replicas = int(after["spec"][0]["replicas"])
        if replicas > MAX_REPLICAS:
            denies.append(f"{rc['address']}: replicas {replicas} > {MAX_REPLICAS}")
    if rc["type"] == "kubernetes_service_v1":
        if after["spec"][0].get("type") == "LoadBalancer":
            denies.append(f"{rc['address']}: public LoadBalancer needs an exception")

for d in denies:
    print("DENY ", d)
print(f"{len(denies)} deny, checked {len(plan.get('resource_changes', []))} changes")
sys.exit(1 if denies else 0)

$ python policy.py bad.json
DENY  kubernetes_deployment_v1.api: missing labels ['owner']
DENY  kubernetes_deployment_v1.api: replicas 8 > 6
DENY  kubernetes_service_v1.api: public LoadBalancer needs an exception
3 deny, checked 3 changes
$ echo $?
1
$ python policy.py good.json
0 deny, checked 3 changes
$ echo $?
0
$ terraform apply good.tfplan
…
Apply complete! Resources: 3 added, 0 changed, 0 destroyed.

// A tiny policy engine over sample Terraform resource changes.
const changes = [
  { address: "aws_s3_bucket_public_access_block.assets", type: "public_access_block",
    actions: ["update"], after: { block_public_policy: false } },
  { address: "google_compute_firewall.ssh", type: "firewall",
    actions: ["create"], after: { source_ranges: ["0.0.0.0/0"], ports: ["22"] } },
  { address: "kubernetes_deployment_v1.api", type: "deployment",
    actions: ["update"], after: { replicas: 8, labels: { app: "bazar" } } },
  { address: "azurerm_storage_account.logs", type: "storage",
    actions: ["create"], after: { min_tls_version: "TLS1_2", tags: { owner: "ops" } } },
];
const rules = [
  { id: "NO_PUBLIC_BUCKET", type: "public_access_block",
    bad: (a) => a.block_public_policy === false ? "public access is allowed" : null },
  { id: "NO_OPEN_SSH", type: "firewall",
    bad: (a) => a.source_ranges.includes("0.0.0.0/0") && a.ports.includes("22")
      ? "port 22 is open to the whole internet" : null },
  { id: "MAX_REPLICAS", type: "deployment",
    bad: (a) => a.replicas > 6 ? "replicas " + a.replicas + " > 6" : null },
  { id: "OWNER_LABEL", type: "deployment",
    bad: (a) => a.labels.owner ? null : "label owner is missing" },
];
const waivers = [{ rule: "MAX_REPLICAS", address: "kubernetes_deployment_v1.api", until: 120 }]; // expires
const today = 100; // simulated day number, so the output never changes
let denies = 0, waived = 0;
for (const c of changes) for (const r of rules) {
  if (r.type !== c.type) continue;
  const why = r.bad(c.after);
  if (!why) continue;
  const w = waivers.find((x) => x.rule === r.id && x.address === c.address && x.until >= today);
  if (w) { waived++; console.log("WAIVED  " + r.id + ": " + why + " (until day " + w.until + ")"); }
  else { denies++; console.log("DENY    " + r.id + ": " + c.address + ": " + why); }
}
console.log("result: " + denies + " deny, " + waived + " waived, " + changes.length + " changes");
console.log(denies ? "exit code 1: stop the pipeline" : "exit code 0: continue");

package main

deny contains msg if {
    rc := input.resource_changes[_]
    rc.type == "kubernetes_deployment_v1"
    rc.change.after != null
    not rc.change.after.metadata[0].labels.owner
    msg := sprintf("%s: owner label is missing", [rc.address])
}

$ conftest test bad.json --policy policy/
FAIL - bad.json - main - kubernetes_deployment_v1.api: owner label is missing

1 test, 0 passed, 0 warnings, 1 failure, 0 exceptions

name: terraform
on:
  pull_request:
    paths: ["infra/**"]
  push:
    branches: [main]
    paths: ["infra/**"]

permissions:
  contents: read
  id-token: write       # short-lived cloud login (OIDC), no stored keys
  pull-requests: write  # lets the job comment on the PR

jobs:
  plan:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: infra
    steps:
      - uses: actions/checkout@v7  # in production pin a full commit SHA
      - uses: hashicorp/setup-terraform@v4
        with:
          terraform_version: 1.17.1
          terraform_wrapper: false
      - run: terraform fmt -check -recursive
      - run: terraform init -input=false
      - run: terraform validate
      - run: terraform test
      - run: terraform plan -input=false -out=tfplan
      - run: terraform show -json tfplan > plan.json
      - run: python3 policy.py plan.json
      - name: Comment the plan on the PR
        if: github.event_name == 'pull_request'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          terraform show -no-color tfplan > plan.txt
          gh pr comment ${{ github.event.pull_request.number }} --body-file plan.txt
      - uses: actions/upload-artifact@v7
        with:
          name: tfplan
          path: infra/tfplan
          retention-days: 1

  apply:
    if: github.event_name == 'push'
    needs: plan
    runs-on: ubuntu-latest
    environment: production  # required reviewers approve here
    concurrency:
      group: terraform-prod
      cancel-in-progress: false  # never kill a running apply
    defaults:
      run:
        working-directory: infra
    steps:
      - uses: actions/checkout@v7
      - uses: hashicorp/setup-terraform@v4
        with:
          terraform_version: 1.17.1
          terraform_wrapper: false
      - uses: actions/download-artifact@v8
        with:
          name: tfplan
          path: infra
      - run: terraform init -input=false
      - run: terraform apply -input=false tfplan

$ terraform plan -out=a.tfplan -var replicas=3
…
Plan: 0 to add, 1 to change, 0 to destroy.
Saved the plan to: a.tfplan
$ terraform apply -auto-approve -var 'labels={app="bazar",owner="team-payments",tier="web"}'
…
Apply complete! Resources: 0 added, 1 changed, 0 destroyed.
$ terraform apply a.tfplan

Error: Saved plan is stale

The given plan file can no longer be applied because the state was changed by
another operation after the plan was created.
$ echo $?
1

// Plan risk score from counts. The weights are our assumption, not a standard.
const weight = { create: 1, update: 2, replace: 8, delete: 10 };
const envFactor = { dev: 1, staging: 2, prod: 4 };
function score(p) {
  const base = p.create * weight.create + p.update * weight.update +
    p.replace * weight.replace + p.delete * weight.delete;
  const stateful = p.statefulTouched * 25;      // database or storage replaced/deleted
  return (base + stateful) * envFactor[p.env];
}
function band(s) {
  if (s < 20) return "low";
  if (s < 80) return "medium";
  return "high";
}
const plans = [
  { name: "new tag on 12 resources", env: "prod", create: 0, update: 12, replace: 0, delete: 0, statefulTouched: 0 },
  { name: "add 3 subnets",           env: "prod", create: 3, update: 1,  replace: 0, delete: 0, statefulTouched: 0 },
  { name: "replace 1 service",       env: "prod", create: 0, update: 1,  replace: 1, delete: 0, statefulTouched: 0 },
  { name: "replace 1 database",      env: "prod", create: 0, update: 0,  replace: 1, delete: 0, statefulTouched: 1 },
  { name: "same database in dev",    env: "dev",  create: 0, update: 0,  replace: 1, delete: 0, statefulTouched: 1 },
  { name: "delete 40 old objects",   env: "staging", create: 0, update: 0, replace: 0, delete: 40, statefulTouched: 0 },
];
console.log("score  band    plan");
for (const p of plans) {
  const s = score(p);
  console.log(String(s).padStart(5) + "  " + band(s).padEnd(6) + "  " + p.name + " (" + p.env + ")");
}

// A pipeline gate: every input is a fact from an earlier stage.
function gate(r) {
  const block = [], review = [];
  if (!r.fmtOk || !r.validateOk) block.push("format or validate failed");
  if (r.testsFailed > 0) block.push(r.testsFailed + " test failed");
  if (r.policyDenies > 0) block.push(r.policyDenies + " policy deny");
  if (r.criticalFindings > 0) block.push(r.criticalFindings + " critical finding");
  if (r.stateSerial !== r.planSerial) block.push("saved plan is stale");
  if (r.deletesProtected > 0) block.push("deletes a protected resource");
  if (r.risk >= 80) review.push("risk " + r.risk);
  if (r.costDelta >= 100) review.push("cost +$" + r.costDelta + "/month");
  if (r.env === "prod") review.push("prod needs a human");
  if (block.length) return "BLOCK  " + block.join("; ");
  if (review.length) return "REVIEW " + review.join("; ");
  return "PASS   safe to apply the saved plan";
}
const ok = { fmtOk: true, validateOk: true, testsFailed: 0, policyDenies: 0, criticalFindings: 0,
  deletesProtected: 0, stateSerial: 42, planSerial: 42, risk: 8, costDelta: 0, env: "dev" };
const cases = [
  ["small dev change", {}],
  ["same change in prod", { env: "prod", risk: 32 }],
  ["costly scale-up", { env: "staging", risk: 24, costDelta: 360 }],
  ["public bucket", { env: "prod", policyDenies: 1 }],
  ["state moved after plan", { env: "prod", stateSerial: 43 }],
  ["database replace", { env: "prod", risk: 132, deletesProtected: 1 }],
  ["format and test fail", { fmtOk: false, testsFailed: 1 }],
];
for (const [name, patch] of cases) {
  console.log(name.padEnd(24) + gate({ ...ok, ...patch }));
}

resource "kubernetes_config_map_v1" "settings" {
  metadata {
    name      = "bazar-settings"
    namespace = "abcl-tp"
  }
  data = { currency = "BDT" }

  lifecycle {
    prevent_destroy = true
  }
}

$ terraform destroy -auto-approve
…
Plan: 0 to add, 0 to change, 3 to destroy.

Error: Instance cannot be destroyed

  on main.tf line 29:
  29: resource "kubernetes_config_map_v1" "settings" {

Resource kubernetes_config_map_v1.settings has lifecycle.prevent_destroy set,
but the plan calls for this resource to be destroyed. To avoid this error and
continue with the plan, either disable lifecycle.prevent_destroy or reduce
the scope of the plan using the -target option.
$ echo $?
1

resource "aws_db_instance" "orders" {
  # ...engine, size and network omitted...
  deletion_protection       = true  # the cloud API itself refuses delete
  skip_final_snapshot       = false
  final_snapshot_identifier = "orders-final"
  backup_retention_period   = 7

  lifecycle {
    prevent_destroy = true          # Terraform refuses at plan time
  }
}

$ kubectl scale deploy bazar-api --replicas=4
deployment.apps/bazar-api scaled
$ terraform plan -refresh-only -detailed-exitcode
…
Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the
last "terraform apply" which may have affected this plan:

  # kubernetes_deployment_v1.api has changed
  ~ resource "kubernetes_deployment_v1" "api" {
…
      ~ spec {
          ~ replicas                  = "2" -> "4"
…
$ echo $?
2