Terraform Validator
This tool is used to validate terraform plans before they are applied. Validations are ran using Forseti Config Validator.
Note: this tool supports Terraform v0.12 by default. To switch to use Terraform v0.11, please see the section Terraform v0.11.
Getting Started
To get started with Terraform Validator, please follow the user guide.
Example Usage
See the Auth section first.
Steps similar both for Terraform v0.11 and v0.12 versions
# The example/ directory contains a basic Terraform config for testing the validator.
cd example/
# Set default credentials.
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/your/credentials.json
# Set a project to test with
export TF_VAR_project_id=my-project-id
# Set the local forseti-config-policies repository path.
export POLICY_PATH=/path/to/your/forseti-config-policies/repo
# Generate a terraform plan.
terraform plan --out=terraform.tfplan
Terraform v0.11
# Switch to use Terraform v0.11 dependencies.
make prepare-v11
# Then run the make command as usual.
make build
# Validate the google resources the plan would create.
terraform-validator validate --policy-path=${POLICY_PATH} ./terraform.tfplan
# Apply the validated plan.
terraform apply ./terraform.tfplan
Terraform v0.12
For 0.12 Terraform release validator required plan exported in JSON format
# Plan JSON representation.
terraform show -json ./terraform.tfplan > ./terraform.tfplan.json
# Validate the google resources the plan would create.
terraform-validator validate --policy-path=${POLICY_PATH} ./terraform.tfplan.json
Apply validated plan
# Apply the validated plan.
terraform apply ./terraform.tfplan
Resources
The follow Terraform resources are supported for running validation checks:
google_compute_disk
google_compute_instance
google_compute_firewall
google_container_cluster
google_container_node_pool
google_storage_bucket
google_storage_bucket_iam_policy
google_storage_bucket_iam_binding
google_storage_bucket_iam_member
google_sql_database_instance
google_project
google_organization_iam_policy
google_organization_iam_binding
google_organization_iam_member
google_folder_iam_policy
google_folder_iam_binding
google_folder_iam_member
google_project_iam_policy
google_project_iam_binding
google_project_iam_member
Testing
Unit
make test
Integration
First, build the Docker container:
make build-docker
See the Auth section for obtaining a credentials file, then start the Docker container:
export PROJECT_ID=my-project-id
export GOOGLE_APPLICATION_CREDENTIALS=$(pwd)/credentials.json
make run-docker
Finally, run the integration tests inside the container:
make test-integration
Auth
The terraform
and the terraform-validator
commands need to be able to authenticate to Google Cloud APIs. This can be done by generating a credentials.json
file:
https://cloud.google.com/docs/authentication/production
Once you have a credentials file on your local machine, set the GOOGLE_APPLICATION_CREDENTIALS
environment variable to point to the credentials file.
Disclaimer
This is not an officially supported Google product.