Terraform 0.12

If the Terraform module has variable files but no external variables, then the array elements that make up the value of

terraform-012-parameters

is as follows.

Key	Value
root-module	Terraform 0.12 root module

The following example shows a cURL request to scan a Terraform 0.12 module that has standard variables.

curl -X POST ’https://<Prisma Cloud API URL>/iac/tf/v1/scan' \
--header 'x-redlock-auth: '<JWT token> \
--header 'Content-Type: multipart/form-data' \
--header 'terraform-version: 0.12' \
--header 'terraform-012-parameters: [{"root-module":"/scan/rich-value-types/"},{"root-module":"/scan/rich-value-types/network/"}]' \
--form 'templateFile=@<path and file name of single Terraform file or zip archive>'

The following example shows the response of a successful request.

{
    "result": {
        "is_successful": true,
        "rules_matched": [
            {
                "severity": "medium",
                "name": "AWS S3 Object Versioning is disabled",
                "rule": " $.resource[*].aws_s3_bucket exists and ($.resource[*].aws_s3_bucket.*[*].*.versioning[*].enabled does not exist or $.resource[*].aws_s3_bucket.*[*].*.versioning[*].enabled anyFalse)",
                "description": "This policy identifies the S3 buckets which have Object Versioning disabled. S3 Object Versioning is an important capability in protecting your data within a bucket. Once you enable Object Versioning, you cannot remove it; you can suspend Object Versioning at any time on a bucket if you do not wish for it to persist. It is recommended to enable Object Versioning on S3.",
                "files": [
                    "/scan/for-expressions"
                ],
                "id": "89ea62c1-3845-4134-b337-cc82203b8ff9"
            }
        ],
        "severity_stats": {
            "high": 0,
            "low": 0,
            "medium": 1
        }
    },
    "response_id": "bb3ba05a-2e31-4fc3-9a8e-91b31f673500"
}

You can set the value of

terraform-012-parameters

to enable a scan of Terraform variable files with custom names or Terraform external variables. If your Terraform module has either of these variable uses, then the value of

terraform-012-parameters

is an array of key/value pairs where the key/value pairs can be one or more of the following.

Key	Value
root-module	Terraform 0.12 root module
variable-files	An array of custom variable file names. The path of each file is relative to your root module.
variables	An array of key/value pairs. Each array element has a name and value that together identify an input variable (e.g. [{“name”:”varName1”,”value”:”varValue1},{“name”:”varName2”,”value”:”varValue2”}]

The following example shows a cURL request to scan a Terraform 0.12 zip archive that has a custom variable file name and external variables.

curl -X POST 'https://<Prisma Cloud API URL>/iac/tf/v1/scan' \
--header 'x-redlock-auth: <JWT token>' \
--header 'Content-Type: multipart/form-data' \
--header 'terraform-version: 0.12' \
--header 'terraform-012-parameters: [{"root-module":"/scan/rich-value-types/"},{"root-module":"/scan/rich-value-types/network/","variable-files":["/scan/rich-value-types/network/variables.tf"]},{"root-module":"/scan/for-expressions/"}]' \
--form 'templateFile=@<absolute file path of template or zip>'	

Terraform 0.11

curl -X POST 'https://<Prisma Cloud API URL>/iac/tf/v1/scan' \
--header 'x-redlock-auth: <JWT token>' \
--header 'Content-Type: multipart/form-data' \
--form 'templateFile=@<absolute file path of template or zip>'	

curl -X POST 'https://<Prisma Cloud API URL>/iac/tf/v1/scan' \
--header 'x-redlock-auth: <JWT token>' \
--header 'Content-Type: multipart/form-data' \
--header ‘rl-parameters: “[{"name":"varName1","value":"varValue1"},{"name":"varName2","value":"varValue2"}]”’ \
--header 'rl-variable-file-names: ["vars.tf.json", "file1.tf"]' \
--form 'templateFile=@<absolute file path of template or zip>'	

{
   "result": {
        "is_successful": true,
        "rules_matched": [
            {
                "severity": "high",
                "name": "AWS Security Groups allow internet traffic to SSH port (22)",
                "rule": "$.resource[*].aws_security_group exists and ($.resource[*].aws_security_group[*].*[*].ingress[?( @.protocol == 'tcp'&& @.from_port<23 && @.to_port>21 )].cidr_blocks[*] contains 0.0.0.0/0 or $.resource[*].aws_security_group[*].*[*].ingress[?( @.protocol == 'tcp' && @.from_port<23 && @.to_port>21 )].ipv6_cidr_blocks[*] contains ::/0)",
                "description": "This policy identifies AWS Security Groups which do allow inbound traffic on SSH port (22) from public internet. Doing so, may allow a bad actor to brute force their way into the system and potentially get access to the entire network.",
                "files": [
                    "demo/securitygroup22.tf"
                ],
                "id": "617b9138-584b-4e8e-ad15-7fbabafbed1a"
            },
            "severity_stats": {
            "high": 0,
            "low": 0,
            "medium": 1
        }
    },
    "response_id": "bb3ba05a-2e31-4fc3-9a8e-91b31f673500"
}