Terraform (AWS) Example

Terraform Plan output is used as an intermediary to package your terraform project into a single file readable by Template Scanner API.

{
  "format_version": "0.1",
  "terraform_version": "0.15.3",
  "planned_values": {
    "root_module": {
      "resources": [
        {
          "address": "aws_dynamodb_table.dynamodb003S1",
          "mode": "managed",
          "type": "aws_dynamodb_table",
          "name": "dynamodb003S1",
          "provider_name": "registry.terraform.io/hashicorp/aws",
          "schema_version": 1,
          "values": {
            "attribute": [{ "name": "TestTableHashKey", "type": "S" }],
            "billing_mode": "PAY_PER_REQUEST",
            "global_secondary_index": [],
            "hash_key": "TestTableHashKey",
            "local_secondary_index": [],
            "name": "mydynamodbtable",
            "point_in_time_recovery": [{ "enabled": true }],
            "range_key": null,
            "read_capacity": null,
            "replica": [],
            "server_side_encryption": [
              {
                "enabled": true,
                "kms_key_arn": "arn:aws:kms:us-east-1:123456789012:key/abcd1234-abcd-1234-abcd-1234abcd1234"
              }
            ],
            "stream_enabled": true,
            "stream_view_type": "NEW_AND_OLD_IMAGES",
            "tags": { "Environment": "test", "Owner": "Sample Team" },
            "tags_all": { "Environment": "test", "Owner": "Sample Team" },
            "timeouts": null,
            "ttl": [],
            "write_capacity": null
          }
        }
      ]
    }
  },
  "resource_changes": [
    {
      "address": "aws_dynamodb_table.dynamodb003S1",
      "mode": "managed",
      "type": "aws_dynamodb_table",
      "name": "dynamodb003S1",
      "provider_name": "registry.terraform.io/hashicorp/aws",
      "change": {
        "actions": ["create"],
        "before": null,
        "after": {
          "attribute": [{ "name": "TestTableHashKey", "type": "S" }],
          "billing_mode": "PAY_PER_REQUEST",
          "global_secondary_index": [],
          "hash_key": "TestTableHashKey",
          "local_secondary_index": [],
          "name": "mydynamodbtable",
          "point_in_time_recovery": [{ "enabled": true }],
          "range_key": null,
          "read_capacity": null,
          "replica": [],
          "server_side_encryption": [
            {
              "enabled": true,
              "kms_key_arn": "arn:aws:kms:us-east-1:123456789012:key/abcd1234-abcd-1234-abcd-1234abcd1234"
            }
          ],
          "stream_enabled": true,
          "stream_view_type": "NEW_AND_OLD_IMAGES",
          "tags": { "Environment": "test", "Owner": "Sample Team" },
          "tags_all": { "Environment": "test", "Owner": "Sample Team" },
          "timeouts": null,
          "ttl": [],
          "write_capacity": null
        },
        "after_unknown": {
          "arn": true,
          "attribute": [{}],
          "global_secondary_index": [],
          "id": true,
          "local_secondary_index": [],
          "point_in_time_recovery": [{}],
          "replica": [],
          "server_side_encryption": [{}],
          "stream_arn": true,
          "stream_label": true,
          "tags": {},
          "tags_all": {},
          "ttl": []
        },
        "before_sensitive": false,
        "after_sensitive": {
          "attribute": [{}],
          "global_secondary_index": [],
          "local_secondary_index": [],
          "point_in_time_recovery": [{}],
          "replica": [],
          "server_side_encryption": [{}],
          "tags": {},
          "tags_all": {},
          "ttl": []
        }
      }
    }
  ],
  "configuration": {
    "provider_config": {
      "aws": {
        "name": "aws",
        "version_constraint": "~\u003e 3.27",
        "expressions": { "region": { "constant_value": "us-east-2" } }
      }
    },
    "root_module": {
      "resources": [
        {
          "address": "aws_dynamodb_table.dynamodb003S1",
          "mode": "managed",
          "type": "aws_dynamodb_table",
          "name": "dynamodb003S1",
          "provider_config_key": "aws",
          "expressions": {
            "attribute": [
              {
                "name": { "constant_value": "TestTableHashKey" },
                "type": { "constant_value": "S" }
              }
            ],
            "billing_mode": { "constant_value": "PAY_PER_REQUEST" },
            "hash_key": { "constant_value": "TestTableHashKey" },
            "name": { "constant_value": "mydynamodbtable" },
            "point_in_time_recovery": [
              { "enabled": { "constant_value": true } }
            ],
            "server_side_encryption": [
              {
                "enabled": { "constant_value": true },
                "kms_key_arn": {
                  "constant_value": "arn:aws:kms:us-east-1:123456789012:key/abcd1234-abcd-1234-abcd-1234abcd1234"
                }
              }
            ],
            "stream_enabled": { "constant_value": true },
            "stream_view_type": { "constant_value": "NEW_AND_OLD_IMAGES" },
            "tags": {
              "constant_value": {
                "Environment": "test",
                "Owner": "Sample Team"
              }
            }
          },
          "schema_version": 1
        }
      ]
    }
  }
}

The following bash script will handle creating terraform plan file and calling template scanner API. Please run script in the same directory as your terraform project.

#!/usr/bin/env bash
# Scans a template file
# Requires "jq" (https://stedolan.github.io/jq/) to be installed

api_key="Your Trend Vision One API Key"
api_base_url="https://api.xdr.trendmicro.com"

terraform plan -out=outputfile

content=$(terraform show -json outputfile | jq '.' -MRs)
payload="{\"type\":\"terraform-template\",\"content\":${content}}"

echo Request:
echo ${payload} | jq '.' -M

echo Response:
curl -s -X POST \
     -H "Authorization: Bearer ${api_key}" \
     -H "Content-Type: application/json" \
     ${api_base_url}/beta/cloudPosture/scanTemplate \
     --data-binary "${payload}" | jq '.' -M