driftctl/pkg/cmd/scan.go

package cmd

import (
	"errors"
	"fmt"
	"os"
	"os/signal"
	"strings"
	"syscall"

	"github.com/cloudskiff/driftctl/pkg"
	"github.com/cloudskiff/driftctl/pkg/alerter"
	"github.com/cloudskiff/driftctl/pkg/cmd/scan/output"
	"github.com/cloudskiff/driftctl/pkg/filter"
	"github.com/cloudskiff/driftctl/pkg/iac/config"
	"github.com/cloudskiff/driftctl/pkg/iac/supplier"
	"github.com/cloudskiff/driftctl/pkg/iac/terraform/state/backend"
	"github.com/cloudskiff/driftctl/pkg/remote"
	"github.com/cloudskiff/driftctl/pkg/resource"
	"github.com/cloudskiff/driftctl/pkg/terraform"
	"github.com/jmespath/go-jmespath"
	"github.com/sirupsen/logrus"
	"github.com/spf13/cobra"
)

type ScanOptions struct {
	Coverage bool
	Detect   bool
	From     config.SupplierConfig
	To       string
	Output   output.OutputConfig
	Filter   *jmespath.JMESPath
}

func NewScanCmd() *cobra.Command {
	opts := &ScanOptions{}

	cmd := &cobra.Command{
		Use:   "scan",
		Short: "Scan",
		Long:  "Scan",
		Args:  cobra.NoArgs,
		PreRunE: func(cmd *cobra.Command, args []string) error {
			from, _ := cmd.Flags().GetString("from")

			iacSource, err := parseFromFlag(from)
			if err != nil {
				return err
			}

			opts.From = *iacSource

			to, _ := cmd.Flags().GetString("to")
			if !remote.IsSupported(to) {
				return fmt.Errorf(
					"unsupported cloud provider '%s'\nValid values are: %s",
					to,
					strings.Join(remote.GetSupportedRemotes(), ","),
				)
			}

			outputFlag, _ := cmd.Flags().GetString("output")
			out, err := parseOutputFlag(outputFlag)
			if err != nil {
				return err
			}
			opts.Output = *out

			filterFlag, _ := cmd.Flags().GetString("filter")
			if filterFlag != "" {
				expr, err := filter.BuildExpression(filterFlag)
				if err != nil {
					return fmt.Errorf("unable to parse filter expression: %s", err.Error())
				}
				opts.Filter = expr
			}

			return nil
		},
		RunE: func(cmd *cobra.Command, args []string) error {
			return scanRun(opts)
		},
	}

	fl := cmd.Flags()
	fl.StringP(
		"filter",
		"",
		"",
		"JMESPath expression to filter on\n"+
			"Examples : \n"+
			"  - Type == 'aws_s3_bucket' (will filter only s3 buckets)\n"+
			"  - Type =='aws_s3_bucket && Id != 'my_bucket' (excludes s3 bucket 'my_bucket')\n"+
			"  - Attr.Tags.Terraform == 'true' (include only resources that have Tag Terraform equal to 'true')\n",
	)
	fl.StringP(
		"output",
		"o",
		output.Example(output.ConsoleOutputType),
		"Output format, by default it will write to the console\n"+
			"Accepted formats are: "+strings.Join(output.SupportedOutputsExample(), ",")+"\n",
	)
	fl.StringP(
		"from",
		"f",
		"tfstate://terraform.tfstate",
		"IaC source, by default try to find local terraform.tfstate file\n"+
			"Accepted schemes are: "+strings.Join(supplier.GetSupportedSchemes(), ",")+"\n",
	)
	supportedRemotes := remote.GetSupportedRemotes()
	fl.StringVarP(
		&opts.To,
		"to",
		"t",
		supportedRemotes[0],
		"Cloud provider source\n"+
			"Accepted values are: "+strings.Join(supportedRemotes, ",")+"\n",
	)

	return cmd
}

func scanRun(opts *ScanOptions) error {
	c := make(chan os.Signal)
	signal.Notify(c, os.Interrupt, syscall.SIGTERM)

	alerter := alerter.NewAlerter()

	err := remote.Activate(opts.To, alerter)
	if err != nil {
		return err
	}

	// Teardown
	defer func() {
		logrus.Trace("Exiting scan cmd")
		terraform.Cleanup()
		logrus.Trace("Exited")
	}()

	scanner := pkg.NewScanner(resource.Suppliers(), alerter)

	iacSupplier, err := supplier.GetIACSupplier(opts.From)
	if err != nil {
		return err
	}
	logrus.WithFields(logrus.Fields{
		"supplier": opts.From.Key,
		"backend":  opts.From.Backend,
		"path":     opts.From.Path,
	}).Debug("Found IAC provider")
	ctl := pkg.NewDriftCTL(scanner, iacSupplier, opts.Filter, alerter)

	go func() {
		<-c
		logrus.Warn("Detected interrupt, cleanup ...")
		ctl.Stop()
	}()

	analysis := ctl.Run()

	if analysis == nil {
		return errors.New("unable to run driftctl")
	}
	out := output.GetOutput(opts.Output)
	return out.Write(analysis)
}

func parseFromFlag(from string) (*config.SupplierConfig, error) {

	schemePath := strings.Split(from, "://")
	if len(schemePath) != 2 || schemePath[1] == "" || schemePath[0] == "" {
		return nil, fmt.Errorf(
			"Unable to parse from flag: %s\nAccepted schemes are: %s",
			from,
			strings.Join(supplier.GetSupportedSchemes(), ","),
		)
	}

	scheme := schemePath[0]
	path := schemePath[1]
	supplierBackend := strings.Split(scheme, "+")
	if len(supplierBackend) > 2 {
		return nil, fmt.Errorf(
			"Unable to parse from scheme: %s\nAccepted schemes are: %s",
			scheme,
			strings.Join(supplier.GetSupportedSchemes(), ","),
		)
	}

	supplierKey := supplierBackend[0]
	if !supplier.IsSupplierSupported(supplierKey) {
		return nil, fmt.Errorf(
			"Unsupported IaC source: %s\nAccepted values are: %s",
			supplierKey,
			strings.Join(supplier.GetSupportedSuppliers(), ","),
		)
	}

	backendString := ""
	if len(supplierBackend) == 2 {
		backendString = supplierBackend[1]
		if !backend.IsSupported(backendString) {
			return nil, fmt.Errorf(
				"Unsupported IaC backend: %s\nAccepted values are: %s",
				backendString,
				strings.Join(backend.GetSupportedBackends(), ","),
			)
		}
	}

	return &config.SupplierConfig{
		Key:     supplierKey,
		Backend: backendString,
		Path:    path,
	}, nil
}

func parseOutputFlag(out string) (*output.OutputConfig, error) {
	schemeOpts := strings.Split(out, "://")
	if len(schemeOpts) < 2 || schemeOpts[0] == "" {
		return nil, fmt.Errorf(
			"Unable to parse output flag: %s\nAccepted formats are: %s",
			out,
			strings.Join(output.SupportedOutputsExample(), ","),
		)
	}

	o := schemeOpts[0]
	if !output.IsSupported(o) {
		return nil, fmt.Errorf(
			"Unsupported output '%s'\nValid formats are: %s",
			o,
			strings.Join(output.SupportedOutputsExample(), ","),
		)
	}

	opts := schemeOpts[1:]
	options := map[string]string{}

	switch o {
	case output.JSONOutputType:
		if len(opts) != 1 || opts[0] == "" {
			return nil, fmt.Errorf(
				"Invalid json output '%s'\nMust be of kind: %s",
				out,
				output.Example(output.JSONOutputType),
			)
		}
		options["path"] = opts[0]
	}

	return &output.OutputConfig{
		Key:     o,
		Options: options,
	}, nil
}