Skip to content

Commit 6780682

Browse files
aristosvoaristosvo
committed
fix: add *_wo_version attribute via autofix as well
1 parent 52316d5 commit 6780682

6 files changed

+82
-43
lines changed

‎rules/ephemeral/aws_write_only_arguments.go

Lines changed: 29 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -19,53 +19,61 @@ type AwsWriteOnlyArgumentsRule struct {
1919
}
2020

2121
type writeOnlyArgument struct {
22-
originalAttribute string
23-
writeOnlyAlternative string
22+
originalAttribute string
23+
writeOnlyAlternative string
24+
writeOnlyVersionAttribute string
2425
}
2526

2627
// NewAwsWriteOnlyArgumentsRule returns new rule with default attributes
2728
func NewAwsWriteOnlyArgumentsRule() *AwsWriteOnlyArgumentsRule {
2829
writeOnlyArguments := map[string][]writeOnlyArgument{
2930
"aws_db_instance": {
3031
{
31-
originalAttribute: "password",
32-
writeOnlyAlternative: "password_wo",
32+
originalAttribute: "password",
33+
writeOnlyAlternative: "password_wo",
34+
writeOnlyVersionAttribute: "password_wo_version",
3335
},
3436
},
3537
"aws_docdb_cluster": {
3638
{
37-
originalAttribute: "master_password",
38-
writeOnlyAlternative: "master_password_wo",
39+
originalAttribute: "master_password",
40+
writeOnlyAlternative: "master_password_wo",
41+
writeOnlyVersionAttribute: "master_password_wo_version",
3942
},
4043
},
4144
"aws_rds_cluster": {
4245
{
43-
originalAttribute: "master_password",
44-
writeOnlyAlternative: "master_password_wo",
46+
originalAttribute: "master_password",
47+
writeOnlyAlternative: "master_password_wo",
48+
writeOnlyVersionAttribute: "master_password_wo_version",
4549
},
4650
},
4751
"aws_redshift_cluster": {
4852
{
49-
originalAttribute: "master_password",
50-
writeOnlyAlternative: "master_password_wo",
53+
originalAttribute: "master_password",
54+
writeOnlyAlternative: "master_password_wo",
55+
writeOnlyVersionAttribute: "master_password_wo_version",
5156
},
5257
},
5358
"aws_redshiftserverless_namespace": {
5459
{
55-
originalAttribute: "admin_user_password",
56-
writeOnlyAlternative: "admin_user_password_wo",
60+
originalAttribute: "admin_user_password",
61+
writeOnlyAlternative: "admin_user_password_wo",
62+
writeOnlyVersionAttribute: "admin_user_password_wo_version",
5763
},
5864
},
5965
"aws_secretsmanager_secret_version": {
6066
{
61-
originalAttribute: "secret_string",
62-
writeOnlyAlternative: "secret_string_wo",
67+
originalAttribute: "secret_string",
68+
writeOnlyAlternative: "secret_string_wo",
69+
writeOnlyVersionAttribute: "secret_string_wo_version",
6370
},
6471
},
6572
"aws_ssm_parameter": {
6673
{
67-
originalAttribute: "value",
68-
writeOnlyAlternative: "value_wo",
74+
originalAttribute: "value",
75+
writeOnlyAlternative: "value_wo",
76+
writeOnlyVersionAttribute: "value_wo_version",
6977
},
7078
},
7179
}
@@ -120,7 +128,11 @@ func (r *AwsWriteOnlyArgumentsRule) Check(runner tflint.Runner) error {
120128
fmt.Sprintf("\"%s\" is a non-ephemeral attribute, which means this secret is stored in state. Please use write-only argument \"%s\".", resourceAttribute.originalAttribute, resourceAttribute.writeOnlyAlternative),
121129
attribute.Expr.Range(),
122130
func(f tflint.Fixer) error {
123-
return f.ReplaceText(attribute.NameRange, resourceAttribute.writeOnlyAlternative)
131+
err := f.ReplaceText(attribute.NameRange, resourceAttribute.writeOnlyAlternative)
132+
if err != nil {
133+
return err
134+
}
135+
return f.InsertTextAfter(attribute.Range, fmt.Sprintf("\n %s = 1", resourceAttribute.writeOnlyVersionAttribute))
124136
},
125137
); err != nil {
126138
return fmt.Errorf("failed to call EmitIssueWithFix(): %w", err)

‎rules/ephemeral/aws_write_only_arguments_rule.go.tmpl

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,9 @@ type AwsWriteOnlyArgumentsRule struct {
1919
}
2020

2121
type writeOnlyArgument struct {
22-
originalAttribute string
23-
writeOnlyAlternative string
22+
originalAttribute string
23+
writeOnlyAlternative string
24+
writeOnlyVersionAttribute string
2425
}
2526

2627
// NewAwsWriteOnlyArgumentsRule returns new rule with default attributes
@@ -29,8 +30,9 @@ func NewAwsWriteOnlyArgumentsRule() *AwsWriteOnlyArgumentsRule {
2930
{{- range $name, $value := . }}
3031
"{{ $name }}": { {{- range $kk, $writeOnly := $value }}
3132
{
32-
originalAttribute: "{{ $writeOnly.OriginalAttribute }}",
33-
writeOnlyAlternative: "{{ $writeOnly.WriteOnlyAlternative }}",
33+
originalAttribute: "{{ $writeOnly.OriginalAttribute }}",
34+
writeOnlyAlternative: "{{ $writeOnly.WriteOnlyAlternative }}",
35+
writeOnlyVersionAttribute: "{{ $writeOnly.WriteOnlyVersionAttribute }}",
3436
},
3537
},
3638
{{- end -}}{{- end }}
@@ -86,7 +88,11 @@ func (r *AwsWriteOnlyArgumentsRule) Check(runner tflint.Runner) error {
8688
fmt.Sprintf("\"%s\" is a non-ephemeral attribute, which means this secret is stored in state. Please use write-only argument \"%s\".", resourceAttribute.originalAttribute, resourceAttribute.writeOnlyAlternative),
8789
attribute.Expr.Range(),
8890
func(f tflint.Fixer) error {
89-
return f.ReplaceText(attribute.NameRange, resourceAttribute.writeOnlyAlternative)
91+
err := f.ReplaceText(attribute.NameRange, resourceAttribute.writeOnlyAlternative)
92+
if err != nil {
93+
return err
94+
}
95+
return f.InsertTextAfter(attribute.Range, fmt.Sprintf("\n %s = 1", resourceAttribute.writeOnlyVersionAttribute))
9096
},
9197
); err != nil {
9298
return fmt.Errorf("failed to call EmitIssueWithFix(): %w", err)

‎rules/ephemeral/aws_write_only_arguments_rule_test.go.tmpl

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,15 +32,17 @@ resource "{{ $name }}" "test" {
3232
},
3333
Fixed: `
3434
resource "{{ $name }}" "test" {
35-
{{ $writeOnly.WriteOnlyAlternative }} = "test"
35+
{{ $writeOnly.WriteOnlyAlternative }} = "test"
36+
{{ $writeOnly.WriteOnlyVersionAttribute }} = 1
3637
}
3738
`,
3839
},
3940
{
4041
Name: "everything is fine {{ $name }}",
4142
Content: `
4243
resource "{{ $name }}" "test" {
43-
{{ $writeOnly.WriteOnlyAlternative }} = "test"
44+
{{ $writeOnly.WriteOnlyAlternative }} = "test"
45+
{{ $writeOnly.WriteOnlyVersionAttribute }} = 1
4446
}
4547
`,
4648
Expected: helper.Issues{},

‎rules/ephemeral/aws_write_only_arguments_test.go

Lines changed: 28 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -30,15 +30,17 @@ resource "aws_db_instance" "test" {
3030
},
3131
Fixed: `
3232
resource "aws_db_instance" "test" {
33-
password_wo = "test"
33+
password_wo = "test"
34+
password_wo_version = 1
3435
}
3536
`,
3637
},
3738
{
3839
Name: "everything is fine aws_db_instance",
3940
Content: `
4041
resource "aws_db_instance" "test" {
41-
password_wo = "test"
42+
password_wo = "test"
43+
password_wo_version = 1
4244
}
4345
`,
4446
Expected: helper.Issues{},
@@ -58,15 +60,17 @@ resource "aws_docdb_cluster" "test" {
5860
},
5961
Fixed: `
6062
resource "aws_docdb_cluster" "test" {
61-
master_password_wo = "test"
63+
master_password_wo = "test"
64+
master_password_wo_version = 1
6265
}
6366
`,
6467
},
6568
{
6669
Name: "everything is fine aws_docdb_cluster",
6770
Content: `
6871
resource "aws_docdb_cluster" "test" {
69-
master_password_wo = "test"
72+
master_password_wo = "test"
73+
master_password_wo_version = 1
7074
}
7175
`,
7276
Expected: helper.Issues{},
@@ -86,15 +90,17 @@ resource "aws_rds_cluster" "test" {
8690
},
8791
Fixed: `
8892
resource "aws_rds_cluster" "test" {
89-
master_password_wo = "test"
93+
master_password_wo = "test"
94+
master_password_wo_version = 1
9095
}
9196
`,
9297
},
9398
{
9499
Name: "everything is fine aws_rds_cluster",
95100
Content: `
96101
resource "aws_rds_cluster" "test" {
97-
master_password_wo = "test"
102+
master_password_wo = "test"
103+
master_password_wo_version = 1
98104
}
99105
`,
100106
Expected: helper.Issues{},
@@ -114,15 +120,17 @@ resource "aws_redshift_cluster" "test" {
114120
},
115121
Fixed: `
116122
resource "aws_redshift_cluster" "test" {
117-
master_password_wo = "test"
123+
master_password_wo = "test"
124+
master_password_wo_version = 1
118125
}
119126
`,
120127
},
121128
{
122129
Name: "everything is fine aws_redshift_cluster",
123130
Content: `
124131
resource "aws_redshift_cluster" "test" {
125-
master_password_wo = "test"
132+
master_password_wo = "test"
133+
master_password_wo_version = 1
126134
}
127135
`,
128136
Expected: helper.Issues{},
@@ -142,15 +150,17 @@ resource "aws_redshiftserverless_namespace" "test" {
142150
},
143151
Fixed: `
144152
resource "aws_redshiftserverless_namespace" "test" {
145-
admin_user_password_wo = "test"
153+
admin_user_password_wo = "test"
154+
admin_user_password_wo_version = 1
146155
}
147156
`,
148157
},
149158
{
150159
Name: "everything is fine aws_redshiftserverless_namespace",
151160
Content: `
152161
resource "aws_redshiftserverless_namespace" "test" {
153-
admin_user_password_wo = "test"
162+
admin_user_password_wo = "test"
163+
admin_user_password_wo_version = 1
154164
}
155165
`,
156166
Expected: helper.Issues{},
@@ -170,15 +180,17 @@ resource "aws_secretsmanager_secret_version" "test" {
170180
},
171181
Fixed: `
172182
resource "aws_secretsmanager_secret_version" "test" {
173-
secret_string_wo = "test"
183+
secret_string_wo = "test"
184+
secret_string_wo_version = 1
174185
}
175186
`,
176187
},
177188
{
178189
Name: "everything is fine aws_secretsmanager_secret_version",
179190
Content: `
180191
resource "aws_secretsmanager_secret_version" "test" {
181-
secret_string_wo = "test"
192+
secret_string_wo = "test"
193+
secret_string_wo_version = 1
182194
}
183195
`,
184196
Expected: helper.Issues{},
@@ -198,15 +210,17 @@ resource "aws_ssm_parameter" "test" {
198210
},
199211
Fixed: `
200212
resource "aws_ssm_parameter" "test" {
201-
value_wo = "test"
213+
value_wo = "test"
214+
value_wo_version = 1
202215
}
203216
`,
204217
},
205218
{
206219
Name: "everything is fine aws_ssm_parameter",
207220
Content: `
208221
resource "aws_ssm_parameter" "test" {
209-
value_wo = "test"
222+
value_wo = "test"
223+
value_wo_version = 1
210224
}
211225
`,
212226
Expected: helper.Issues{},

‎rules/ephemeral/generator/main.go

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,9 @@ import (
1010
)
1111

1212
type writeOnlyArgument struct {
13-
OriginalAttribute string
14-
WriteOnlyAlternative string
13+
OriginalAttribute string
14+
WriteOnlyAlternative string
15+
WriteOnlyVersionAttribute string
1516
}
1617

1718
func main() {
@@ -38,10 +39,13 @@ func findReplaceableAttribute(arguments []string, resource *tfjson.Schema) []wri
3839

3940
for _, argument := range arguments {
4041
// Check if the argument ends with "_wo" and if the original attribute without "_wo" suffix exists in the resource schema
41-
if attribute := strings.TrimSuffix(argument, "_wo"); strings.HasSuffix(argument, "_wo") && resource.Block.Attributes[attribute] != nil {
42+
attribute := strings.TrimSuffix(argument, "_wo")
43+
versionAttribute := attribute + "_wo_version"
44+
if strings.HasSuffix(argument, "_wo") && resource.Block.Attributes[attribute] != nil && resource.Block.Attributes[versionAttribute] != nil {
4245
writeOnlyArguments = append(writeOnlyArguments, writeOnlyArgument{
43-
OriginalAttribute: attribute,
44-
WriteOnlyAlternative: argument,
46+
OriginalAttribute: attribute,
47+
WriteOnlyAlternative: argument,
48+
WriteOnlyVersionAttribute: versionAttribute,
4549
})
4650
}
4751
}

‎rules/provider.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ var manualRules = []tflint.Rule{
4444
NewAwsProviderMissingDefaultTagsRule(),
4545
NewAwsSecurityGroupInlineRulesRule(),
4646
NewAwsSecurityGroupRuleDeprecatedRule(),
47+
NewAwsIAMRoleDeprecatedPolicyAttributesRule(),
4748
ephemeral.NewAwsWriteOnlyArgumentsRule(),
4849
}
4950

0 commit comments

Comments
 (0)