Terraform Validator

This tool is used to validate terraform plans before they are applied. Validations are ran using Forseti Config Validator.

Note: this tool supports Terraform v0.12 by default. To switch to use Terraform v0.11, please see the section Terraform v0.11.

Getting Started

To get started with Terraform Validator, please follow the user guide.

Example Usage

See the Auth section first.

Terraform 0.12 Usage

# The example/ directory contains a basic Terraform config for testing the validator.
cd example/

# Set default credentials.
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/your/credentials.json

# Set a project and org to test with
export TF_VAR_project_id=my-project-id
export TF_VAR_org_id=93392932

# Set the local forseti-config-policies repository path.
export POLICY_PATH=/path/to/your/forseti-config-policies/repo

# Generate a terraform plan.
terraform plan --out=terraform.tfplan

# Plan JSON representation.
terraform show -json ./terraform.tfplan > ./terraform.tfplan.json

# Validate the google resources the plan would create.
terraform-validator validate --policy-path=${POLICY_PATH} ./terraform.tfplan.json

# Apply the validated plan.
terraform apply ./terraform.tfplan

Terraform v0.11

Terraform 0.11 is no longer officially supported.

Resources

The follow Terraform resources are supported for running validation checks:

• google_bigquery_dataset
• google_compute_disk
• google_compute_firewall
• google_compute_instance
• google_container_cluster
• google_container_node_pool
• google_folder_iam_binding
• google_folder_iam_member
• google_folder_iam_policy
• google_organization_iam_binding
• google_organization_iam_member
• google_organization_iam_policy
• google_project
• google_project_iam_binding
• google_project_iam_member
• google_project_iam_policy
• google_sql_database_instance
• google_storage_bucket
• google_storage_bucket_iam_binding
• google_storage_bucket_iam_member
• google_storage_bucket_iam_policy

Testing

Unit

make test

Integration

First, build the Docker container:

make build-docker

See the Auth section for obtaining a credentials file, then start the Docker container:

export PROJECT_ID=my-project-id
export GOOGLE_APPLICATION_CREDENTIALS=$(pwd)/credentials.json
make run-docker

Finally, run the integration tests inside the container:

make test-integration

Auth

The terraform and the terraform-validator commands need to be able to authenticate to Google Cloud APIs. This can be done by generating a credentials.json file:

https://cloud.google.com/docs/authentication/production

Once you have a credentials file on your local machine, set the GOOGLE_APPLICATION_CREDENTIALS environment variable to point to the credentials file.

Disclaimer

This is not an officially supported Google product.