Skip to main content

Evaluate your Second Terraform Plan

Now, imagine you change your Terraform file to address the policy violation by adding the EC2 instance to a VPC. The updated JSON file is shown below. Download it to the file sampleplan2.json.

{
"format_version": "0.1",
"terraform_version": "0.12.30",
"planned_values": {
"root_module": {
"resources": [
{
"address": "aws_iam_policy.new_iam_policy",
"mode": "managed",
"type": "aws_iam_policy",
"name": "new_iam_policy",
"provider_name": "aws",
"schema_version": 0,
"values": {
"description": "An IAM policy that has overly broad permissions",
"name": "new_iam_policy",
"name_prefix": null,
"path": "/",
"policy": "{\"Statement\":[{\"Action\":[\"s3:BypassGovernanceRetention\",\"s3:CreateBucket\",\"s3:CreateJob\",\"s3:DeleteAccessPoint\",\"s3:*\"],\"Effect\":\"Allow\",\"Resource\":\"*\",\"Sid\":\"S3Access\"}],\"Version\":\"2012-10-17\"}",
"tags": null
}
},
{
"address": "aws_instance.new_ec2",
"mode": "managed",
"type": "aws_instance",
"name": "new_ec2",
"provider_name": "aws",
"schema_version": 1,
"values": {
"ami": "ami-830c94e3",
"credit_specification": [],
"disable_api_termination": null,
"ebs_optimized": null,
"get_password_data": false,
"hibernation": null,
"iam_instance_profile": null,
"instance_initiated_shutdown_behavior": null,
"instance_type": "t2.micro",
"monitoring": null,
"source_dest_check": true,
"tags": {
"Name": "ExampleInstance"
},
"timeouts": null,
"user_data": null,
"user_data_base64": null,
"volume_tags": null,
"vpc_security_group_ids": [
"sg-123456"
]
}
}
]
}
},
"resource_changes": [
{
"address": "aws_iam_policy.new_iam_policy",
"mode": "managed",
"type": "aws_iam_policy",
"name": "new_iam_policy",
"provider_name": "aws",
"change": {
"actions": [
"create"
],
"before": null,
"after": {
"description": "An IAM policy that has overly broad permissions",
"name": "new_iam_policy",
"name_prefix": null,
"path": "/",
"policy": "{\"Statement\":[{\"Action\":[\"s3:BypassGovernanceRetention\",\"s3:CreateBucket\",\"s3:CreateJob\",\"s3:DeleteAccessPoint\",\"s3:*\"],\"Effect\":\"Allow\",\"Resource\":\"*\",\"Sid\":\"S3Access\"}],\"Version\":\"2012-10-17\"}",
"tags": null
},
"after_unknown": {
"arn": true,
"id": true,
"policy_id": true
}
}
},
{
"address": "aws_instance.new_ec2",
"mode": "managed",
"type": "aws_instance",
"name": "new_ec2",
"provider_name": "aws",
"change": {
"actions": [
"create"
],
"before": null,
"after": {
"ami": "ami-830c94e3",
"credit_specification": [],
"disable_api_termination": null,
"ebs_optimized": null,
"get_password_data": false,
"hibernation": null,
"iam_instance_profile": null,
"instance_initiated_shutdown_behavior": null,
"instance_type": "t2.micro",
"monitoring": null,
"source_dest_check": true,
"tags": {
"Name": "ExampleInstance"
},
"timeouts": null,
"user_data": null,
"user_data_base64": null,
"volume_tags": null,
"vpc_security_group_ids": [
"sg-123456"
]
},
"after_unknown": {
"arn": true,
"associate_public_ip_address": true,
"availability_zone": true,
"cpu_core_count": true,
"cpu_threads_per_core": true,
"credit_specification": [],
"ebs_block_device": true,
"enclave_options": true,
"ephemeral_block_device": true,
"host_id": true,
"id": true,
"instance_state": true,
"ipv6_address_count": true,
"ipv6_addresses": true,
"key_name": true,
"metadata_options": true,
"network_interface": true,
"outpost_arn": true,
"password_data": true,
"placement_group": true,
"primary_network_interface_id": true,
"private_dns": true,
"private_ip": true,
"public_dns": true,
"public_ip": true,
"root_block_device": true,
"secondary_private_ips": true,
"security_groups": true,
"subnet_id": true,
"tags": {},
"tenancy": true,
"vpc_security_group_ids": [
false
]
}
}
}
],
"configuration": {
"provider_config": {
"aws": {
"name": "aws",
"expressions": {
"profile": {
"constant_value": "tf-example"
},
"region": {
"constant_value": "us-east-1"
}
}
}
},
"root_module": {
"resources": [
{
"address": "aws_iam_policy.new_iam_policy",
"mode": "managed",
"type": "aws_iam_policy",
"name": "new_iam_policy",
"provider_config_key": "aws",
"expressions": {
"description": {
"constant_value": "An IAM policy that has overly broad permissions"
},
"name": {
"constant_value": "new_iam_policy"
},
"path": {
"constant_value": "/"
},
"policy": {}
},
"schema_version": 0
},
{
"address": "aws_instance.new_ec2",
"mode": "managed",
"type": "aws_instance",
"name": "new_ec2",
"provider_config_key": "aws",
"expressions": {
"ami": {
"constant_value": "ami-830c94e3"
},
"instance_type": {
"constant_value": "t2.micro"
},
"tags": {
"constant_value": {
"Name": "ExampleInstance"
}
},
"vpc_security_group_ids": {
"constant_value": [
"sg-123456"
]
}
},
"schema_version": 1
}
]
}
}
}

Go back to your terminal and re-run the policy checks to see that your Terraform plan is now free of violations.

./styra vet sampleplan2.json

Policy checks like these can be run in CICD pipelines or even on developer laptops before they try to merge their Terraform files into version control.