Skip to main content

Evaluate your First Terraform Plan

Normally, you would create your own Terraform plan, convert it to JSON, and then run policies against it. To get started quickly, below is a sample Terraform plan converted to JSON. Copy the following JSON and put it in the file sampleplan.json in the same directory you used for the Styra CLI.

{
"format_version": "0.1",
"terraform_version": "0.12.30",
"planned_values": {
"root_module": {
"resources": [
{
"address": "aws_iam_policy.new_iam_policy",
"mode": "managed",
"type": "aws_iam_policy",
"name": "new_iam_policy",
"provider_name": "aws",
"schema_version": 0,
"values": {
"description": "An IAM policy that has overly broad permissions",
"name": "new_iam_policy",
"name_prefix": null,
"path": "/",
"policy": "{\"Statement\":[{\"Action\":[\"s3:BypassGovernanceRetention\",\"s3:CreateBucket\",\"s3:CreateJob\",\"s3:DeleteAccessPoint\",\"s3:*\"],\"Effect\":\"Allow\",\"Resource\":\"*\",\"Sid\":\"S3Access\"}],\"Version\":\"2012-10-17\"}",
"tags": null
}
},
{
"address": "aws_instance.new_ec2",
"mode": "managed",
"type": "aws_instance",
"name": "new_ec2",
"provider_name": "aws",
"schema_version": 1,
"values": {
"ami": "ami-830c94e3",
"credit_specification": [],
"disable_api_termination": null,
"ebs_optimized": null,
"get_password_data": false,
"hibernation": null,
"iam_instance_profile": null,
"instance_initiated_shutdown_behavior": null,
"instance_type": "t2.micro",
"monitoring": null,
"source_dest_check": true,
"tags": {
"Name": "ExampleInstance"
},
"timeouts": null,
"user_data": null,
"user_data_base64": null,
"volume_tags": null
}
}
]
}
},
"resource_changes": [
{
"address": "aws_iam_policy.new_iam_policy",
"mode": "managed",
"type": "aws_iam_policy",
"name": "new_iam_policy",
"provider_name": "aws",
"change": {
"actions": [
"create"
],
"before": null,
"after": {
"description": "An IAM policy that has overly broad permissions",
"name": "new_iam_policy",
"name_prefix": null,
"path": "/",
"policy": "{\"Statement\":[{\"Action\":[\"s3:BypassGovernanceRetention\",\"s3:CreateBucket\",\"s3:CreateJob\",\"s3:DeleteAccessPoint\",\"s3:*\"],\"Effect\":\"Allow\",\"Resource\":\"*\",\"Sid\":\"S3Access\"}],\"Version\":\"2012-10-17\"}",
"tags": null
},
"after_unknown": {
"arn": true,
"id": true,
"policy_id": true
}
}
},
{
"address": "aws_instance.new_ec2",
"mode": "managed",
"type": "aws_instance",
"name": "new_ec2",
"provider_name": "aws",
"change": {
"actions": [
"create"
],
"before": null,
"after": {
"ami": "ami-830c94e3",
"credit_specification": [],
"disable_api_termination": null,
"ebs_optimized": null,
"get_password_data": false,
"hibernation": null,
"iam_instance_profile": null,
"instance_initiated_shutdown_behavior": null,
"instance_type": "t2.micro",
"monitoring": null,
"source_dest_check": true,
"tags": {
"Name": "ExampleInstance"
},
"timeouts": null,
"user_data": null,
"user_data_base64": null,
"volume_tags": null
},
"after_unknown": {
"arn": true,
"associate_public_ip_address": true,
"availability_zone": true,
"cpu_core_count": true,
"cpu_threads_per_core": true,
"credit_specification": [],
"ebs_block_device": true,
"enclave_options": true,
"ephemeral_block_device": true,
"host_id": true,
"id": true,
"instance_state": true,
"ipv6_address_count": true,
"ipv6_addresses": true,
"key_name": true,
"metadata_options": true,
"network_interface": true,
"outpost_arn": true,
"password_data": true,
"placement_group": true,
"primary_network_interface_id": true,
"private_dns": true,
"private_ip": true,
"public_dns": true,
"public_ip": true,
"root_block_device": true,
"secondary_private_ips": true,
"security_groups": true,
"subnet_id": true,
"tags": {},
"tenancy": true,
"vpc_security_group_ids": true
}
}
}
],
"configuration": {
"provider_config": {
"aws": {
"name": "aws",
"expressions": {
"profile": {
"constant_value": "tf-example"
},
"region": {
"constant_value": "us-east-1"
}
}
}
},
"root_module": {
"resources": [
{
"address": "aws_iam_policy.new_iam_policy",
"mode": "managed",
"type": "aws_iam_policy",
"name": "new_iam_policy",
"provider_config_key": "aws",
"expressions": {
"description": {
"constant_value": "An IAM policy that has overly broad permissions"
},
"name": {
"constant_value": "new_iam_policy"
},
"path": {
"constant_value": "/"
},
"policy": {}
},
"schema_version": 0
},
{
"address": "aws_instance.new_ec2",
"mode": "managed",
"type": "aws_instance",
"name": "new_ec2",
"provider_config_key": "aws",
"expressions": {
"ami": {
"constant_value": "ami-830c94e3"
},
"instance_type": {
"constant_value": "t2.micro"
},
"tags": {
"constant_value": {
"Name": "ExampleInstance"
}
}
},
"schema_version": 1
}
]
}
}
}

Now, go back to your terminal and evaluate your policies against the sample Terraform plan using the Styra CLI.

./styra vet sampleplan.json

The configuration file you downloaded earlier tells the Styra CLI which DAS system to use to download (and cache) the policies to use.

This Terraform plan violates the policy you put in place on the DAS, and the Styra CLI provides the related information.