Terraform GCP Compliance
Run compliance and security controls to detect Terraform GCP resources deviating from security best practices prior to deployment in your GCP projects.
References
Terraform is an open-source infrastructure as code software tool that provides a consistent CLI workflow to manage hundreds of cloud services.
Steampipe is an open source CLI to instantly query cloud APIs using SQL.
Steampipe Mods are collections of named queries
, and codified controls
that can be used to test current configuration of your cloud resources against a desired configuration.
Documentation
Getting started
Installation
Download and install Steampipe (https://steampipe.io/downloads). Or use Brew:
brew tap turbot/tapbrew install steampipe
Install the terraform plugin with Steampipe:
steampipe plugin install terraform
Clone:
git clone https://github.com/turbot/steampipe-mod-terraform-gcp-compliance.git
Usage
By default, the Terraform plugin configuration loads Terraform configuration files in your current working directory (CWD).
To get started, change your CWD to where your TF files are located:
cd /path/to/tf_files
Then set the STEAMPIPE_WORKSPACE_CHDIR
environment variable to the mod directory so Steampipe knows where to load benchmarks from:
export STEAMPIPE_WORKSPACE_CHDIR=/path/to/steampipe-mod-terraform-gcp-compliance
Start your dashboard server:
steampipe dashboard
By default, the dashboard interface will then be launched in a new browser window at https://localhost:9194. From here, you can run benchmarks by selecting one or searching for a specific one.
Instead of running benchmarks in a dashboard, you can also run them within your
terminal with the steampipe check
command.
Run all benchmarks:
steampipe check all
Run all benchmarks for a specific compliance framework using tags:
steampipe check all --tag cft_scorecard_v1=true
Run a benchmark:
steampipe check terraform_gcp_compliance.benchmark.bigquery
Run a specific control:
steampipe check terraform_gcp_compliance.control.kms_key_rotated_within_100_day
When running checks from the CWD, you can also run the steampipe dashboard
and steampipe check
commands using the --workspace-chdir
command line argument:
steampipe dashboard --workspace-chdir=/path/to/steampipe-mod-terraform-gcp-compliancesteampipe check all --workspace-chdir=/path/to/steampipe-mod-terraform-gcp-compliance
Different output formats are also available, for more information please see Output Formats.
Credentials
No credentials are required.
Configuration
If you want to run benchmarks and controls across multiple directories
containing Terraform configuration files, they can be run from within the
steampipe-mod-terraform-gcp-compliance
mod directory after configuring the
Terraform plugin configuration:
vi ~/.steampipe/config/terraform.spc
connection "terraform" { plugin = "terraform" paths = ["/path/to/files/*.tf", "/path/to/nested/files/**/*.tf"]}
After setting up your Terraform plugin configuration, navigate to the steampipe-mod-terraform-gcp-compliance
mod directory and start the dashboard server:
cd /path/to/steampipe-mod-terraform-gcp-compliancesteampipe dashboard
For more details on connection configuration, please refer to Terraform Plugin Configuration.
Contributing
If you have an idea for additional controls or just want to help maintain and extend this mod (or others) we would love you to join the community and start contributing.
- Join our Slack community → and hang out with other Mod developers.
Please see the contribution guidelines and our code of conduct. All contributions are subject to the Apache 2.0 open source license.
Want to help but not sure where to start? Pick up one of the help wanted
issues: