Skip to content

Commit

Permalink
Documentation tf module scanning (bridgecrewio#512)
Browse files Browse the repository at this point in the history
* DOCS - Add info for scanning 3rd party TF modules with Checkov

* DOCS - Add info for scanning 3rd party TF modules with Checkov
  • Loading branch information
metahertz authored Aug 24, 2020
1 parent a4c4731 commit e471c35
Show file tree
Hide file tree
Showing 2 changed files with 35 additions and 1 deletion.
36 changes: 35 additions & 1 deletion docs/2.Concepts/Evaluations.md
Original file line number Diff line number Diff line change
Expand Up @@ -140,4 +140,38 @@ evaluations: {
},
...
}
```
```
# Further Terraform Concepts
## Scanning third party Terraform modules
Third party Terraform modules often reduce complexity for deploying services made up of many objects.
For example, the third party EKS module by howdio reduces the terraform required to the nine lines below, however, in doing so abstracts the terraform configuration away from a regular Checkov scan on the current directory.
```
module "eks" {
source = "howdio/eks/aws"
name = "examplecluster"
default_vpc = true
enable_kubectl = true
enable_dashboard = true
}
```
To ensure coverage of objects within these modules, you can instruct checkov to scan the `.terraform` directory, after a `terraform init`, which will have retreived the third party modules and any associated `.tf` files.
```sh
terraform init
checkov -d . # Your TF files.
checkov -d .terraform # Module TF files.
```
![module-scanning-screenshot](https://raw.githubusercontent.com/bridgecrewio/checkov/master/docs/scanning-terraform-module.png)
It is worth noting however, when scanning the `.terraform` directory, Checkov cannot differentiate between third party and internally written modules, however, you will gain scanning coverage for all of them.
Binary file added docs/scanning-terraform-module.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.

0 comments on commit e471c35

Please sign in to comment.