feat : add infracost (647bf442) · Commits · to be continuous... / Terraform

README.md

+47 −5

Original line number	Diff line number	Diff line
		@@ -329,7 +329,49 @@ Examples:
		[checkov](https://github.com/bridgecrewio/checkov) is a static code analysis tool for infrastructure-as-code and uses the following variables:

		\| Name \| description \| default value \|
		\| --------------------- \| ---------------------------------------- \| ----------------- \|
		\| -------------------- \| ------------------------------------------------------------------------------------------ \| -------------------- \|
		\| `TF_CHECKOV_IMAGE` \| the Docker image used to run checkov \| `bridgecrew/checkov` \|
		\| `TF_CHECKOV_ENABLED` \| Set to `true` to enable checkov \| _none_ (disabled) \|
		\| `TF_CHECKOV_ARGS` \| checkov [options and args](https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html) \| `--directory .` \|

		You can skip checkov specific check adding following comment in code :

		```terraform
		resource "aws_s3_bucket" "foo-bucket" {
		region = var.region
		#checkov:skip=CKV_AWS_20:The bucket is a public static content host
		bucket = local.bucket_name
		force_destroy = true
		acl = "public-read"
		}
		```

		### `infracost` job

		[Infracost](https://github.com/infracost/infracost) shows cloud cost estimates for infrastructure-as-code projects and uses the following variables:

		\| Name \| description \| default value \|
		\| ---------------------- \| ----------------------------- \| --------------------- \|
		\| `TF_INFRACOST_ENABLED` \| Set to `true` to enable infracost \| _none_ (disabled) \|
		\| `TF_INFRACOST_IMAGE` \| the infracost container image \| `infracost/infracost` \|
		\| `TF_INFRACOST_ARGS` \| infracost [CLI options and args](https://www.infracost.io/docs/#usage) \| `breakdown` \|
		\| `TF_INFACOST_USAGE_FILE` \| infracost [usage file](https://www.infracost.io/docs/usage_based_resources/#infracost-usage-file) \| `infracost-usage.yml` \|
		\| :lock: `INFRACOST_API_KEY`\| the infracost API key \| required \|

		To use infracost, an api key is needed.
		To obtain it run :

		```bash
		docker run -it --name infracost infracost/infracost register
		Please enter your name and email address to get an API key.
		See our FAQ (https://www.infracost.io/docs/faq) for more details.
		Name: Your Name
		✔ Email: you_email@domain█

		Thank you !
		Your API key is: api_key
		```

		Save the API key as :lock: `INFRACOST_API_KEY` GitLab secret variable.

		Set `INFRACOST_CURRENCY` variable to set currency [ISO 4217](https://en.wikipedia.org/wiki/ISO_4217#Active_codes) prices should be converted to. Defaults to USD.

kicker.json

+29 −0

Original line number	Diff line number	Diff line
		@@ -99,6 +99,35 @@
		}
		]
		},
		{
		"id": "infracost",
		"name": "infracost",
		"description": "Shows cloud cost estimates for infrastructure-as-code projects",
		"enable_with": "TF_INFRACOST_ENABLED",
		"variables": [
		{
		"name": "TF_INFRACOST_IMAGE",
		"description": "Infracost docker image",
		"default": "infracost/infracost",
		"advanced": true
		},
		{
		"name": "TF_INFRACOST_ARGS",
		"description": "infracost [CLI options and args](https://www.infracost.io/docs/#usage)",
		"default": "breakdown"
		},
		{
		"name": "TF_INFACOST_USAGE_FILE",
		"description": "infracost [usage file](https://www.infracost.io/docs/usage_based_resources/#infracost-usage-file)",
		"default": "infracost-usage.yml"
		},
		{
		"name": "INFRACOST_API_KEY",
		"description": "the infracost API key",
		"secret": true
		}
		]
		},
		{
		"id": "tflint",
		"name": "tflint",

templates/gitlab-ci-terraform.yml

+37 −0

Original line number	Diff line number	Diff line
		@@ -22,6 +22,9 @@ variables:
		TF_TFLINT_IMAGE: "wata727/tflint"
		TF_CHECKOV_IMAGE: "bridgecrew/checkov"
		TF_CHECKOV_ARGS: "--framework terraform --directory ."
		TF_INFRACOST_IMAGE: "infracost/infracost"
		TF_INFRACOST_ARGS: "breakdown"
		TF_INFACOST_USAGE_FILE: "infracost-usage.yml"

		# root module directory
		TF_PROJECT_DIR: "."
		@@ -374,6 +377,17 @@ stages:
		terraform show --json "$tf_plan" \| jq -r '([.resource_changes[]?.change.actions?]\|flatten)\|{"create":(map(select(.=="create"))\|length),"update":(map(select(.=="update"))\|length),"delete":(map(select(.=="delete"))\|length)}' > "$gitlab_report"
		}

		tf_infracost() {
		# shellcheck disable=SC2154
		log_info "--- \\e[32minfracost\\e[0m"

		if [[ "${TF_INFACOST_USAGE_FILE}" ]];then
		tf_usagefile="--sync-usage-file --usage-file ${TF_INFACOST_USAGE_FILE}"
		fi
		# shellcheck disable=SC2086
		infracost ${TF_INFRACOST_ARGS} ${tf_usagefile} --path .
		}

		function tf_apply() {
		opts=$1
		extra_opts=$2
		@@ -634,6 +648,29 @@ tf-checkov:
		- if: '$TF_CHECKOV_ENABLED == "true"'
		allow_failure: true

		tf-infracost:
		extends: .tf-base
		image:
		name : $TF_INFRACOST_IMAGE
		entrypoint: [""]
		stage: test
		before_script:
		- *tf-scripts
		- cd "$TF_PROJECT_DIR"
		script:
		- tf_infracost
		rules:
		# exclude merge requests
		- if: $CI_MERGE_REQUEST_ID
		when: never
		# on any branch: when $TF_INFRACOST_ENABLED is set
		# on production or integration branches: auto
		- if: '$TF_INFRACOST_ENABLED == "true" && ($CI_COMMIT_REF_NAME =~ $PROD_REF \|\| $CI_COMMIT_REF_NAME =~ $INTEG_REF)'
		# else (development branches): allow failure
		- if: '$TF_INFRACOST_ENABLED == "true"'
		allow_failure: true


		# =============================================================================
		# === Review env jobs
		# =============================================================================