sundowndev
/
driftctl
mirror of https://github.com/sundowndev/driftctl.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1123 from cloudskiff/res/api_gtw_rest_api_policy 

Add aws_api_gateway_rest_api_policy resource
main
Elie 2021-10-19 14:27:28 +02:00 committed by GitHub
parent 5d8a127c38 08e29d8d43
commit 7b84f9c1e8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
16 changed files with 172369 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
pkg/driftctl.go
View File

@ -110,6 +110,10 @@ func (d DriftCTL) Run() (*analyser.Analysis, error) {
middlewares.NewTagsAllManager(),
middlewares.NewEipAssociationExpander(d.resourceFactory),
middlewares.NewRDSClusterInstanceExpander(d.resourceFactory),
middlewares.NewAwsApiGatewayDeploymentExpander(d.resourceFactory),
middlewares.NewAwsApiGatewayResourceExpander(d.resourceFactory),
middlewares.NewAwsApiGatewayRestApiExpander(d.resourceFactory),
middlewares.NewAwsApiGatewayRestApiPolicyExpander(d.resourceFactory),
middlewares.NewGoogleStorageBucketIAMBindingTransformer(d.resourceFactory),
middlewares.NewGoogleStorageBucketIAMPolicyTransformer(d.resourceFactory),
@ -117,9 +121,6 @@ func (d DriftCTL) Run() (*analyser.Analysis, error) {
middlewares.NewAzurermRouteExpander(d.resourceFactory),
middlewares.NewAzurermSubnetExpander(d.resourceFactory),
middlewares.NewAwsApiGatewayDeploymentExpander(d.resourceFactory),
middlewares.NewAwsApiGatewayResourceExpander(d.resourceFactory),
middlewares.NewAwsApiGatewayRestApiExpander(d.resourceFactory),
)
if !d.opts.StrictMode {

1
pkg/iac/terraform/state/terraform_state_reader_test.go
View File

@ -160,6 +160,7 @@ func TestTerraformStateReader_AWS_Resources(t *testing.T) {
{name: "Api Gateway domain name", dirName: "api_gateway_domain_name", wantErr: false},
{name: "Api Gateway vpc link", dirName: "api_gateway_vpc_link", wantErr: false},
{name: "Api Gateway request validator", dirName: "api_gateway_request_validator", wantErr: false},
{name: "Api Gateway rest api policy", dirName: "api_gateway_rest_api_policy", wantErr: false},
{name: "AppAutoScaling Targets", dirName: "aws_appautoscaling_target", wantErr: false},
{name: "network acl", dirName: "aws_network_acl", wantErr: false},
{name: "network acl rule", dirName: "aws_network_acl_rule", wantErr: false},

20
pkg/iac/terraform/state/test/api_gateway_rest_api_policy/results.golden.json Executable file
View File

@ -0,0 +1,20 @@
[
{
"Id": "c3n3aqga5d",
"Type": "aws_api_gateway_rest_api_policy",
"Attrs": {
"id": "c3n3aqga5d",
"policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"execute-api:Invoke\",\"Resource\":\"arn:aws:execute-api:us-east-1:047081014315:c3n3aqga5d/*\",\"Condition\":{\"IpAddress\":{\"aws:SourceIp\":\"123.123.123.123/32\"}}}]}",
"rest_api_id": "c3n3aqga5d"
}
},
{
"Id": "uwk4xvbm04",
"Type": "aws_api_gateway_rest_api_policy",
"Attrs": {
"id": "uwk4xvbm04",
"policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"execute-api:Invoke\",\"Resource\":\"arn:aws:execute-api:us-east-1:047081014315:uwk4xvbm04/*\",\"Condition\":{\"IpAddress\":{\"aws:SourceIp\":\"12.12.12.12/32\"}}}]}",
"rest_api_id": "uwk4xvbm04"
}
}
]

171757
pkg/iac/terraform/state/test/api_gateway_rest_api_policy/schema.golden.json Executable file
View File

File diff suppressed because it is too large Load Diff

51
pkg/iac/terraform/state/test/api_gateway_rest_api_policy/terraform.tfstate Normal file
View File

@ -0,0 +1,51 @@
{
"version": 4,
"terraform_version": "1.0.7",
"serial": 149,
"lineage": "85f5bee6-139e-8db2-ae5d-82aa82f62611",
"outputs": {},
"resources": [
{
"mode": "managed",
"type": "aws_api_gateway_rest_api_policy",
"name": "test",
"provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"id": "c3n3aqga5d",
"policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"execute-api:Invoke\",\"Resource\":\"arn:aws:execute-api:us-east-1:047081014315:c3n3aqga5d/*\",\"Condition\":{\"IpAddress\":{\"aws:SourceIp\":\"123.123.123.123/32\"}}}]}",
"rest_api_id": "c3n3aqga5d"
},
"sensitive_attributes": [],
"private": "bnVsbA==",
"dependencies": [
"aws_api_gateway_rest_api.test"
]
}
]
},
{
"mode": "managed",
"type": "aws_api_gateway_rest_api_policy",
"name": "test-5",
"provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"id": "uwk4xvbm04",
"policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"execute-api:Invoke\",\"Resource\":\"arn:aws:execute-api:us-east-1:047081014315:uwk4xvbm04/*\",\"Condition\":{\"IpAddress\":{\"aws:SourceIp\":\"12.12.12.12/32\"}}}]}",
"rest_api_id": "uwk4xvbm04"
},
"sensitive_attributes": [],
"private": "bnVsbA==",
"dependencies": [
"aws_api_gateway_rest_api.test-5"
]
}
]
}
]
}

80
pkg/middlewares/aws_api_gateway_rest_api_policy_expander.go Normal file
View File

@ -0,0 +1,80 @@
package middlewares
import (
"github.com/cloudskiff/driftctl/pkg/resource"
"github.com/cloudskiff/driftctl/pkg/resource/aws"
"github.com/sirupsen/logrus"
)
// Explodes policy found in aws_api_gateway_rest_api.policy from state resources to dedicated resources
type AwsApiGatewayRestApiPolicyExpander struct {
resourceFactory resource.ResourceFactory
}
func NewAwsApiGatewayRestApiPolicyExpander(resourceFactory resource.ResourceFactory) AwsApiGatewayRestApiPolicyExpander {
return AwsApiGatewayRestApiPolicyExpander{
resourceFactory: resourceFactory,
}
}
func (m AwsApiGatewayRestApiPolicyExpander) Execute(_, resourcesFromState *[]*resource.Resource) error {
newList := make([]*resource.Resource, 0)
for _, res := range *resourcesFromState {
// Ignore all resources other than api_gateway_rest_api
if res.ResourceType() != aws.AwsApiGatewayRestApiResourceType {
newList = append(newList, res)
continue
}
newList = append(newList, res)
if hasRestApiPolicyAttached(res.ResourceId(), resourcesFromState) {
res.Attrs.SafeDelete([]string{"policy"})
continue
}
err := m.handlePolicy(res, &newList)
if err != nil {
return err
}
}
*resourcesFromState = newList
return nil
}
func (m *AwsApiGatewayRestApiPolicyExpander) handlePolicy(api *resource.Resource, results *[]*resource.Resource) error {
policy, exist := api.Attrs.Get("policy")
if !exist || policy == nil || policy == "" {
return nil
}
data := map[string]interface{}{
"id": api.ResourceId(),
"rest_api_id": api.ResourceId(),
"policy": policy,
}
newPolicy := m.resourceFactory.CreateAbstractResource(aws.AwsApiGatewayRestApiPolicyResourceType, api.ResourceId(), data)
*results = append(*results, newPolicy)
logrus.WithFields(logrus.Fields{
"id": newPolicy.ResourceId(),
}).Debug("Created new policy from api gateway rest api")
api.Attrs.SafeDelete([]string{"policy"})
return nil
}
// Return true if the rest api has a aws_api_gateway_rest_api_policy resource attached to itself.
// It is mandatory since it's possible to have a aws_api_gateway_rest_api with an inline policy
// AND a aws_api_gateway_rest_api_policy resource at the same time. At the end, on the AWS console,
// the aws_api_gateway_rest_api_policy will be used.
func hasRestApiPolicyAttached(api string, resourcesFromState *[]*resource.Resource) bool {
for _, res := range *resourcesFromState {
if res.ResourceType() == aws.AwsApiGatewayRestApiPolicyResourceType &&
res.ResourceId() == api {
return true
}
}
return false
}

158
pkg/middlewares/aws_api_gateway_rest_api_policy_expander_test.go Normal file
View File

@ -0,0 +1,158 @@
package middlewares
import (
"strings"
"testing"
"github.com/aws/aws-sdk-go/aws/awsutil"
"github.com/cloudskiff/driftctl/pkg/resource"
"github.com/cloudskiff/driftctl/pkg/resource/aws"
"github.com/cloudskiff/driftctl/pkg/terraform"
"github.com/r3labs/diff/v2"
)
func TestAwsApiGatewayRestApiPolicyPolicyExpander_Execute(t *testing.T) {
tests := []struct {
name string
resourcesFromState []*resource.Resource
mocks func(*terraform.MockResourceFactory)
expected []*resource.Resource
}{
{
name: "Inline policy, no aws_api_gateway_rest_api_policy attached",
mocks: func(factory *terraform.MockResourceFactory) {
factory.On(
"CreateAbstractResource",
aws.AwsApiGatewayRestApiPolicyResourceType,
"foo",
map[string]interface{}{
"id": "foo",
"rest_api_id": "foo",
"policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"execute-api:Invoke\",\"Resource\":\"arn:aws:execute-api:us-east-1:011111111111:rrwhncu4h2/*\"}]}",
},
).Once().Return(&resource.Resource{
Id: "foo",
Type: aws.AwsApiGatewayRestApiPolicyResourceType,
})
},
resourcesFromState: []*resource.Resource{
{
Id: "foo",
Type: aws.AwsApiGatewayRestApiResourceType,
Attrs: &resource.Attributes{
"policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"execute-api:Invoke\",\"Resource\":\"arn:aws:execute-api:us-east-1:011111111111:rrwhncu4h2/*\"}]}",
},
},
},
expected: []*resource.Resource{
{
Id: "foo",
Type: aws.AwsApiGatewayRestApiResourceType,
Attrs: &resource.Attributes{},
},
{
Id: "foo",
Type: aws.AwsApiGatewayRestApiPolicyResourceType,
},
},
},
{
name: "No inline policy, aws_api_gateway_rest_api_policy attached",
resourcesFromState: []*resource.Resource{
{
Id: "foo",
Type: aws.AwsApiGatewayRestApiResourceType,
Attrs: &resource.Attributes{},
},
{
Id: "foo",
Type: aws.AwsApiGatewayRestApiPolicyResourceType,
},
},
expected: []*resource.Resource{
{
Id: "foo",
Type: aws.AwsApiGatewayRestApiResourceType,
Attrs: &resource.Attributes{},
},
{
Id: "foo",
Type: aws.AwsApiGatewayRestApiPolicyResourceType,
},
},
},
{
name: "Inline policy and aws_api_gateway_rest_api_policy",
resourcesFromState: []*resource.Resource{
{
Id: "foo",
Type: aws.AwsApiGatewayRestApiResourceType,
Attrs: &resource.Attributes{
"policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"execute-api:Invoke\",\"Resource\":\"arn:aws:execute-api:us-east-1:011111111111:rrwhncu4h2/*\"}]}",
},
},
{
Id: "foo",
Type: aws.AwsApiGatewayRestApiPolicyResourceType,
},
},
expected: []*resource.Resource{
{
Id: "foo",
Type: aws.AwsApiGatewayRestApiResourceType,
Attrs: &resource.Attributes{},
},
{
Id: "foo",
Type: aws.AwsApiGatewayRestApiPolicyResourceType,
},
},
},
{
name: "empty policy",
resourcesFromState: []*resource.Resource{
{
Id: "foo",
Type: aws.AwsApiGatewayRestApiResourceType,
Attrs: &resource.Attributes{
"policy": "",
},
},
},
expected: []*resource.Resource{
{
Id: "foo",
Type: aws.AwsApiGatewayRestApiResourceType,
Attrs: &resource.Attributes{
"policy": "",
},
},
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
factory := &terraform.MockResourceFactory{}
if tt.mocks != nil {
tt.mocks(factory)
}
m := NewAwsApiGatewayRestApiPolicyExpander(factory)
err := m.Execute(&[]*resource.Resource{}, &tt.resourcesFromState)
if err != nil {
t.Fatal(err)
}
changelog, err := diff.Diff(tt.expected, tt.resourcesFromState)
if err != nil {
t.Fatal(err)
}
if len(changelog) > 0 {
for _, change := range changelog {
t.Errorf("%s got = %v, want %v", strings.Join(change.Path, "."), awsutil.Prettify(change.From), awsutil.Prettify(change.To))
}
}
})
}
}

86
pkg/remote/api_gateway_scanner_test.go
View File

@ -813,3 +813,89 @@ func TestApiGatewayRequestValidator(t *testing.T) {
})
}
}
func TestApiGatewayRestApiPolicy(t *testing.T) {
dummyError := errors.New("this is an error")
tests := []struct {
test string
mocks func(*repository.MockApiGatewayRepository, *mocks.AlerterInterface)
assertExpected func(t *testing.T, got []*resource.Resource)
wantErr error
}{
{
test: "no api gateway rest api policies",
mocks: func(repository *repository.MockApiGatewayRepository, alerter *mocks.AlerterInterface) {
repository.On("ListAllRestApis").Return([]*apigateway.RestApi{
{Id: awssdk.String("3of73v5ob4")},
{Id: awssdk.String("9x7kq9pbyh"), Policy: awssdk.String("")},
}, nil)
},
assertExpected: func(t *testing.T, got []*resource.Resource) {
assert.Len(t, got, 0)
},
},
{
test: "multiple api gateway rest api policies",
mocks: func(repository *repository.MockApiGatewayRepository, alerter *mocks.AlerterInterface) {
repository.On("ListAllRestApis").Return([]*apigateway.RestApi{
{Id: awssdk.String("c3n3aqga5d"), Policy: awssdk.String("{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"execute-api:Invoke\",\"Resource\":\"arn:aws:execute-api:us-east-1:111111111111:c3n3aqga5d/*\",\"Condition\":{\"IpAddress\":{\"aws:SourceIp\":\"123.123.123.123/32\"}}}]}")},
{Id: awssdk.String("9y1eus3hr7"), Policy: awssdk.String("{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"execute-api:Invoke\",\"Resource\":\"arn:aws:execute-api:us-east-1:111111111111:9y1eus3hr7/*\",\"Condition\":{\"IpAddress\":{\"aws:SourceIp\":\"123.123.123.123/32\"}}}]}")},
}, nil)
},
assertExpected: func(t *testing.T, got []*resource.Resource) {
assert.Len(t, got, 2)
assert.Equal(t, got[0].ResourceId(), "c3n3aqga5d")
assert.Equal(t, got[0].ResourceType(), resourceaws.AwsApiGatewayRestApiPolicyResourceType)
assert.Equal(t, got[1].ResourceId(), "9y1eus3hr7")
assert.Equal(t, got[1].ResourceType(), resourceaws.AwsApiGatewayRestApiPolicyResourceType)
},
},
{
test: "cannot list rest apis",
mocks: func(repo *repository.MockApiGatewayRepository, alerter *mocks.AlerterInterface) {
repo.On("ListAllRestApis").Return(nil, dummyError)
alerter.On("SendAlert", resourceaws.AwsApiGatewayRestApiPolicyResourceType, alerts.NewRemoteAccessDeniedAlert(common.RemoteAWSTerraform, remoteerr.NewResourceListingErrorWithType(dummyError, resourceaws.AwsApiGatewayRestApiPolicyResourceType, resourceaws.AwsApiGatewayRestApiResourceType), alerts.EnumerationPhase)).Return()
},
wantErr: remoteerr.NewResourceListingErrorWithType(dummyError, resourceaws.AwsApiGatewayRestApiPolicyResourceType, resourceaws.AwsApiGatewayRestApiResourceType),
},
}
providerVersion := "3.19.0"
schemaRepository := testresource.InitFakeSchemaRepository("aws", providerVersion)
resourceaws.InitResourcesMetadata(schemaRepository)
factory := terraform.NewTerraformResourceFactory(schemaRepository)
for _, c := range tests {
t.Run(c.test, func(tt *testing.T) {
scanOptions := ScannerOptions{}
remoteLibrary := common.NewRemoteLibrary()
// Initialize mocks
alerter := &mocks.AlerterInterface{}
fakeRepo := &repository.MockApiGatewayRepository{}
c.mocks(fakeRepo, alerter)
var repo repository.ApiGatewayRepository = fakeRepo
remoteLibrary.AddEnumerator(aws.NewApiGatewayRestApiPolicyEnumerator(repo, factory))
testFilter := &filter.MockFilter{}
testFilter.On("IsTypeIgnored", mock.Anything).Return(false)
s := NewScanner(remoteLibrary, alerter, scanOptions, testFilter)
got, err := s.Resources()
assert.Equal(tt, err, c.wantErr)
if err != nil {
return
}
c.assertExpected(tt, got)
alerter.AssertExpectations(tt)
fakeRepo.AssertExpectations(tt)
testFilter.AssertExpectations(tt)
})
}
}

49
pkg/remote/aws/api_gateway_rest_api_policy_enumerator.go Normal file
View File

@ -0,0 +1,49 @@
package aws
import (
"github.com/cloudskiff/driftctl/pkg/remote/aws/repository"
remoteerror "github.com/cloudskiff/driftctl/pkg/remote/error"
"github.com/cloudskiff/driftctl/pkg/resource"
"github.com/cloudskiff/driftctl/pkg/resource/aws"
)
type ApiGatewayRestApiPolicyEnumerator struct {
repository repository.ApiGatewayRepository
factory resource.ResourceFactory
}
func NewApiGatewayRestApiPolicyEnumerator(repo repository.ApiGatewayRepository, factory resource.ResourceFactory) *ApiGatewayRestApiPolicyEnumerator {
return &ApiGatewayRestApiPolicyEnumerator{
repository: repo,
factory: factory,
}
}
func (e *ApiGatewayRestApiPolicyEnumerator) SupportedType() resource.ResourceType {
return aws.AwsApiGatewayRestApiPolicyResourceType
}
func (e *ApiGatewayRestApiPolicyEnumerator) Enumerate() ([]*resource.Resource, error) {
apis, err := e.repository.ListAllRestApis()
if err != nil {
return nil, remoteerror.NewResourceListingErrorWithType(err, string(e.SupportedType()), aws.AwsApiGatewayRestApiResourceType)
}
results := make([]*resource.Resource, 0)
for _, api := range apis {
a := api
if a.Policy == nil || *a.Policy == "" {
continue
}
results = append(
results,
e.factory.CreateAbstractResource(
string(e.SupportedType()),
*a.Id,
map[string]interface{}{},
),
)
}
return results, err
}

1
pkg/remote/aws/init.go
View File

@ -191,6 +191,7 @@ func Init(version string, alerter *alerter.Alerter,
remoteLibrary.AddEnumerator(NewApiGatewayDomainNameEnumerator(apigatewayRepository, factory))
remoteLibrary.AddEnumerator(NewApiGatewayVpcLinkEnumerator(apigatewayRepository, factory))
remoteLibrary.AddEnumerator(NewApiGatewayRequestValidatorEnumerator(apigatewayRepository, factory))
remoteLibrary.AddEnumerator(NewApiGatewayRestApiPolicyEnumerator(apigatewayRepository, factory))
remoteLibrary.AddEnumerator(NewAppAutoscalingTargetEnumerator(appAutoScalingRepository, factory))
remoteLibrary.AddDetailsFetcher(aws.AwsAppAutoscalingTargetResourceType, common.NewGenericDetailsFetcher(aws.AwsAppAutoscalingTargetResourceType, provider, deserializer))

3
pkg/resource/aws/aws_api_gateway_rest_api_policy.go Normal file
View File

@ -0,0 +1,3 @@
package aws
const AwsApiGatewayRestApiPolicyResourceType = "aws_api_gateway_rest_api_policy"

30
pkg/resource/aws/aws_api_gateway_rest_api_policy_test.go Normal file
View File

@ -0,0 +1,30 @@
package aws_test
import (
"testing"
"github.com/cloudskiff/driftctl/test"
"github.com/cloudskiff/driftctl/test/acceptance"
)
func TestAcc_Aws_ApiGatewayRestApiPolicy(t *testing.T) {
acceptance.Run(t, acceptance.AccTestCase{
TerraformVersion: "0.15.5",
Paths: []string{"./testdata/acc/aws_api_gateway_rest_api_policy"},
Args: []string{"scan"},
Checks: []acceptance.AccCheck{
{
Env: map[string]string{
"AWS_REGION": "us-east-1",
},
Check: func(result *test.ScanResult, stdout string, err error) {
if err != nil {
t.Fatal(err)
}
result.AssertInfrastructureIsInSync()
result.AssertManagedCount(3)
},
},
},
})
}

2
pkg/resource/aws/testdata/acc/aws_api_gateway_rest_api_policy/.driftignore vendored Normal file
View File

@ -0,0 +1,2 @@
*
!aws_api_gateway_rest_api_policy

20
pkg/resource/aws/testdata/acc/aws_api_gateway_rest_api_policy/.terraform.lock.hcl vendored Normal file
View File

@ -0,0 +1,20 @@
# This file is maintained automatically by "terraform init".
# Manual edits may be lost in future updates.
provider "registry.terraform.io/hashicorp/aws" {
version = "3.19.0"
constraints = "3.19.0"
hashes = [
"h1:xur9tF49NgsovNnmwmBR8RdpN8Fcg1TD4CKQPJD6n1A=",
"zh:185a5259153eb9ee4699d4be43b3d509386b473683392034319beee97d470c3b",
"zh:2d9a0a01f93e8d16539d835c02b8b6e1927b7685f4076e96cb07f7dd6944bc6c",
"zh:703f6da36b1b5f3497baa38fccaa7765fb8a2b6440344e4c97172516b49437dd",
"zh:770855565462abadbbddd98cb357d2f1a8f30f68a358cb37cbd5c072cb15b377",
"zh:8008db43149fe4345301f81e15e6d9ddb47aa5e7a31648f9b290af96ad86e92a",
"zh:8cdd27d375da6dcb7687f1fed126b7c04efce1671066802ee876dbbc9c66ec79",
"zh:be22ae185005690d1a017c1b909e0d80ab567e239b4f06ecacdba85080667c1c",
"zh:d2d02e72dbd80f607636cd6237a6c862897caabc635c7b50c0cb243d11246723",
"zh:d8f125b66a1eda2555c0f9bbdf12036a5f8d073499a22ca9e4812b68067fea31",
"zh:f5a98024c64d5d2973ff15b093725a074c0cb4afde07ef32c542e69f17ac90bc",
]
}

105
pkg/resource/aws/testdata/acc/aws_api_gateway_rest_api_policy/terraform.tf vendored Normal file
View File

@ -0,0 +1,105 @@
provider "aws" {
region = "us-east-1"
}
terraform {
required_providers {
aws = "3.19.0"
}
}
resource "aws_api_gateway_rest_api" "foo" {
name = "foo"
description = "This is foo API"
}
resource "aws_api_gateway_rest_api_policy" "foo" {
rest_api_id = aws_api_gateway_rest_api.foo.id
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": "execute-api:Invoke",
"Resource" : [
"execute-api:/*"
],
"Condition": {
"IpAddress": {
"aws:SourceIp": "123.123.123.123/32"
}
}
}
]
}
EOF
}
resource "aws_api_gateway_rest_api" "bar" {
name = "bar"
description = "This is bar API"
policy = <<POLICY
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": "execute-api:Invoke",
"Resource" : [
"execute-api:/*"
],
"Condition": {
"IpAddress": {
"aws:SourceIp": "123.123.123.123/32"
}
}
}
]
}
POLICY
}
resource "aws_api_gateway_rest_api" "baz" {
name = "baz"
description = "This is baz API"
body = jsonencode({
openapi = "3.0.1"
info = {
title = "example"
version = "1.0"
}
paths = {
"/path1" = {
get = {
x-amazon-apigateway-integration = {
httpMethod = "GET"
payloadFormatVersion = "1.0"
type = "HTTP_PROXY"
uri = "https://ip-ranges.amazonaws.com/ip-ranges.json"
}
}
}
}
"x-amazon-apigateway-policy" : {
"Version" : "2012-10-17",
"Statement" : [
{
"Effect" : "Allow",
"Principal" : "*",
"Action" : "execute-api:Invoke",
"Resource" : [
"execute-api:/*"
]
},
]
}
})
}

2
pkg/resource/resource_types.go
View File

@ -103,6 +103,7 @@ var supportedTypes = map[string]ResourceTypeMeta{
"aws_cloudformation_stack": {},
"aws_api_gateway_rest_api": {children: []ResourceType{
"aws_api_gateway_resource",
"aws_api_gateway_rest_api_policy",
}},
"aws_api_gateway_account": {},
"aws_api_gateway_api_key": {},
@ -115,6 +116,7 @@ var supportedTypes = map[string]ResourceTypeMeta{
"aws_api_gateway_domain_name": {},
"aws_api_gateway_vpc_link": {},
"aws_api_gateway_request_validator": {},
"aws_api_gateway_rest_api_policy": {},
"aws_appautoscaling_target": {},
"aws_rds_cluster_instance": {children: []ResourceType{
"aws_db_instance",