terraform-tfsec-pipeline.yml

trigger: none

pool:
  vmImage: 'ubuntu-latest'

stages:
- stage: QualityCheckStage
  displayName: Quality Check Stage
  jobs:
    - job: TFSecJob
      displayName: Run TFSec Scan
      steps:
      # TFSec uses static analysis of Terraform templates to spot potential security issues, and 
      # checks for violations of AWS, Azure and GCP security best practice recommendations.
      # NOTE: To disable a specific check from analysis, include it in the command-line as 
      # follows: -e GEN001,GCP001,GCP002
      # Documentation: https://github.com/tfsec/tfsec
      - bash: |
          mkdir TFSecReport
          docker pull liamg/tfsec:latest
          docker run --rm -v $(System.DefaultWorkingDirectory)/terraform/azure:/src liamg/tfsec ./src --format JUnit > $(System.DefaultWorkingDirectory)/TFSecReport/TFSec-Report.xml
          docker run --rm -v $(System.DefaultWorkingDirectory)/terraform:/src liamg/tfsec ./src
        displayName: TFSec Static Code Analysis
        name: TFSecScan
        condition: always()
      # Publish the TFSec report as an artifact to Azure Pipelines
      - task: PublishBuildArtifacts@1
        displayName: 'Publish Artifact: TFSec Report'
        condition: succeededOrFailed()
        inputs:
          PathtoPublish: '$(System.DefaultWorkingDirectory)/TFSecReport'
          ArtifactName: TFSecReport

      # Publish the results of the TFSec analysis as Test Results to the pipeline
      - task: PublishTestResults@2
        displayName: Publish TFSecReport Test Results
        condition: succeededOrFailed()
        inputs:
          testResultsFormat: 'JUnit' # Options JUnit, NUnit, VSTest, xUnit, cTest
          testResultsFiles: '**/*TFSec-Report.xml'
          searchFolder: '$(System.DefaultWorkingDirectory)/TFSecReport'
          testRunTitle: TFSec Scan
          mergeTestResults: false
          failTaskOnFailedTests: false
          publishRunAttachments: true

      # Clean up any of the containers / images that were used for quality checks
      - bash: |
          docker rmi "liamg/tfsec:latest" -f | true
        displayName: 'Remove Terraform Quality Check Docker Images'
        condition: always()