Terraform Validator

This tool is used to validate terraform plans before they are applied. Validations are based on policies from the Config Validator Policy Library.

Note: Using Terraform Validator does not require an active installation of Forseti. Terraform Validator is a self-contained binary.

Note: this tool supports Terraform v0.12+.

Getting Started

To get started with Terraform Validator, please follow the user guide.

Example Usage

See the Auth section first.

Terraform 0.12+ Usage

# The example/ directory contains a basic Terraform config for testing the validator.
cd example/

# Set default credentials.
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/your/credentials.json

# Set a project and org to test with
export TF_VAR_project_id=my-project-id
export TF_VAR_org_id=93392932

# Set the local forseti-config-policies repository path.
export POLICY_PATH=/path/to/your/forseti-config-policies/repo

# Generate a terraform plan.
terraform plan --out=terraform.tfplan

# Plan JSON representation.
terraform show -json ./terraform.tfplan > ./terraform.tfplan.json

# Validate the google resources the plan would create.
terraform-validator validate --policy-path=${POLICY_PATH} ./terraform.tfplan.json

# Apply the validated plan.
terraform apply ./terraform.tfplan

Resources

The follow Terraform resources are supported for running validation checks:

• google_bigquery_dataset
• google_compute_disk
• google_compute_firewall
• google_compute_instance
• google_container_cluster
• google_container_node_pool
• google_folder_iam_binding
• google_folder_iam_member
• google_folder_iam_policy
• google_organization_iam_binding
• google_organization_iam_member
• google_organization_iam_policy
• google_project
• google_project_iam_binding
• google_project_iam_member
• google_project_iam_policy
• google_sql_database_instance
• google_storage_bucket
• google_storage_bucket_iam_binding
• google_storage_bucket_iam_member
• google_storage_bucket_iam_policy

Testing

Unit

make test

Integration

First, build the Docker container:

make build-docker

See the Auth section for obtaining a credentials file, then start the Docker container:

export PROJECT_ID=my-project-id
export GOOGLE_APPLICATION_CREDENTIALS=$(pwd)/credentials.json
make run-docker

Finally, run the integration tests inside the container:

make test-integration

Auth

The terraform and the terraform-validator commands need to be able to authenticate to Google Cloud APIs. This can be done by generating a credentials.json file:

https://cloud.google.com/docs/authentication/production

Once you have a credentials file on your local machine, set the GOOGLE_APPLICATION_CREDENTIALS environment variable to point to the credentials file.

Disclaimer

This is not an officially supported Google product.