Guardrails / iac

Terraform modules are pinned

iac/terraform-modules-pinned@v1

Every module a Terraform root takes from a registry or a git URL names the version it takes, so the same commit resolves to the same module twice.

Id	iac/terraform-modules-pinned
Version	v1
Category	iac
Default severity	error
Interpreter	python3
Timeout	30 seconds
Violations tolerated	0
Collects	terraform

Collectors

This guardrail gathers nothing itself. It depends on the collectors below, which the CLI runs once per build before any check, and reads what they found out of GUARDRAIL_FACTS. A collector that collects nothing skips this guardrail rather than failing it.

Collector	Gathers	Inputs it is given
terraform	The Terraform configuration in the checkout: every root directory holding .tf files, the backend it stores state in, the providers and modules it takes on and how tightly they are pinned, the resources it declares, the variables it takes, the lock file that resolves it, and any state file left in the tree. Read out of the files themselves, so it works on a runner with no Terraform installed, and enriched with the versions an initialised root has already resolved when the terraform CLI is there.	none

The inputs above are this guardrail's own, passed straight through. Configuring one in buildnote.json changes what is collected, and two guardrails configured the same way share the one collection.

Configuration

{
  "guardrails": {
      "failOn": "error",
      "comment": true,
      "checks": [
          {
              "use": "iac/terraform-modules-pinned@v1",
              "severity": "error",
              "with": {
                  "allowMovableRefs": "false"
              },
              "exemptions": []
          }
      ]
  }
}

Inputs

Input	Description	Default	Environment variable
allowMovableRefs	Whether a git source pinned to a tag or a branch rather than to a commit sha counts as pinned. false requires a 40 character sha, which is the only ref nobody can move.	false	GUARDRAIL_INPUT_ALLOWMOVABLEREFS

How to fix

Pin the modules named in the violations. A registry source pins with version:

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.8.1"
}

A git source pins with a ref in the URL, and a tag is not enough because a tag moves:

module "vpc" {
  source = "git::https://github.com/acme/terraform-vpc.git?ref=6f3a1c2d9b8e4f7a0c5d2e1b3a4f5c6d7e8f9a0b"
}

An unpinned module means the plan you reviewed and the plan that applied can be built from different code. A module in this repository, taken with a relative source, is already pinned by the commit and is not judged.

More in iac

• iac/dockerfile-base-pinned. Every image a Dockerfile builds from is pinned to a digest, so a rebuild of the same commit starts from the same bytes.
• iac/dockerfile-healthcheck. Every Dockerfile declares a HEALTHCHECK, so the orchestrator can tell a container that is running from one that is working.
• iac/dockerfile-lint-clean. Every finding the Dockerfile linter reported sits below the severity the team gates on.
• iac/dockerfile-no-build-secrets. No ARG or ENV a Dockerfile declares is named like a credential.
• iac/dockerfile-nonroot-user. Every Dockerfile ends on a USER that is not root, so the container runs its process unprivileged.
• iac/terraform-no-plaintext-secrets. Every Terraform variable named like a credential declares sensitive = true.
• iac/terraform-providers-pinned. Every provider a live Terraform root requires is pinned to one exact version, and the lock file that resolves them is committed.
• iac/terraform-remote-state. Every live Terraform root stores its state in a remote backend, and no state file is left in the checkout.

All 11 iac guardrails