This message was deleted.
# atlantis-communitys
Slackbot
10/20/2023, 9:42 PMThis message was deleted.
p
PePe Amengual
10/20/2023, 9:53 PMyes that is a Terraform problem
PePe Amengual
10/20/2023, 9:53 PMthere is tools like tfsec that help on certain aspects of this
PePe Amengual
10/20/2023, 9:53 PMThe state is a secret and it should be handled the same way
r
RB
10/20/2023, 9:54 PMHow would you even prevent this without using something like tfsec (as you already mentioned)
RB
10/20/2023, 9:54 PMMaybe if the runner didn't require those env vars
p
PePe Amengual
10/20/2023, 9:54 PMand I will say
externalš 2
PePe Amengual
10/20/2023, 9:54 PMideally you will remove the installation of that provider
PePe Amengual
10/20/2023, 9:54 PMthat is where you need to stop it
PePe Amengual
10/20/2023, 9:55 PMsame as a dangerous package/dependency for any other language in the world, terraform is no different
PePe Amengual
10/20/2023, 9:56 PMutilities like Nexusx IQ, Snyk and other will alert you about the security concern for a python or java app
PePe Amengual
10/20/2023, 9:57 PMyou can run checkov after init and fail if it finds something
PePe Amengual
10/20/2023, 9:57 PMand even before atlantis is triggered it fails the run
r
RB
10/20/2023, 10:06 PMYou can do it with a conftest policy too
RB
10/20/2023, 10:06 PMI think there is a doc on the Atlantis website for exactly this use case
b
Bruno Schaatsbergen
10/20/2023, 11:57 PMI think what Walter is aiming at, is that any person can just create a feature branch and add this to his feature branch, prep a PR and the data is exposed
Bruno Schaatsbergen
10/20/2023, 11:57 PMcheckov, tfsec, conftest could block this from getting merged - sure. But then it's already too late
Bruno Schaatsbergen
10/20/2023, 11:58 PMThen again, good luck solving this...
Bruno Schaatsbergen
10/20/2023, 11:59 PMThis comes down to write permissions and securing your repositories the right way
p
PePe Amengual
10/20/2023, 11:59 PMThat is not totally correct, if you commit code and for example use Github you can stop sending the webhook call to atlantis by checking with those tools
b
Bruno Schaatsbergen
10/20/2023, 11:59 PMHmm I was not aware of that PePe, how would that work? That's good to know actually
p
PePe Amengual
10/20/2023, 11:59 PMone of you github actions can check for the existance of certain providers and remove them from the code
r
RB
10/20/2023, 11:59 PMConftest can also block the code itself not just the plan
this 1
RB
10/20/2023, 11:59 PMI use conftest today on the code
b
Bruno Schaatsbergen
10/21/2023, 12:00 AMDo you have some reference material on how to prevent the auto plan (webhooks) from going off with conftest?
p
PePe Amengual
10/21/2023, 12:00 AM@RB can you remove provider with conftest? like if
externalb
Bruno Schaatsbergen
10/21/2023, 12:02 AMI would happily contribute some docs to our 'Webooks' page in that case
p
PePe Amengual
10/21/2023, 12:02 AMPePe Amengual
10/21/2023, 12:02 AMlook at that action
PePe Amengual
10/21/2023, 12:03 AMit call atlantis at the end, not via webhook
b
Bruno Schaatsbergen
10/21/2023, 12:03 AMAh... just a layer in between, I see
p
PePe Amengual
10/21/2023, 12:04 AMso then you run all your checks and then you send over
PePe Amengual
10/21/2023, 12:04 AMbut @RB I think is mention that you can run this as a pre_workflow hook and check using onftest and opa rules
b
Bruno Schaatsbergen
10/21/2023, 12:05 AMIf only our conftest implementation could run before the auto plan too š
p
PePe Amengual
10/21/2023, 12:05 AMand that will happen before autoplan
b
Bruno Schaatsbergen
10/21/2023, 12:05 AMYeah that can work
Bruno Schaatsbergen
10/21/2023, 12:06 AMIs it worth documenting a gotcha on the Webhooks page regarding pre_workflow hooks in order to prevent data exfiltration?
r
RB
10/21/2023, 12:07 AMI run conftest part of the atlantis workflow on the code. If it errors on the code then the plan doesn't run. Just an alternative to consider
b
Bruno Schaatsbergen
10/21/2023, 12:15 AM@Walter Vargas tldr;
ā¢ You can use pre workflow hooks to prevent the plan from going off, by e.g. using conftest or tfsec
ā¢ You can embed it into your own workflow, as @RB outlined above
ā¢ You can also construct your own workflows that wrap around atlantis, see @PePe Amengual his answer
Enough options available to prevent running arbitrary code š
š 1
s
Simon Heather
10/23/2023, 1:12 PMIf using pre-workflow hooks, don't forget to set fail-on-pre-workflow-hook-error.
š 1
r
RB
10/23/2023, 1:23 PMHmm how come that not just automatically enabled when using pre workflow hooks?
b
Bruno Schaatsbergen
10/23/2023, 1:23 PMautomatically turning it on and having a
continue-on-pre-workflow-hook-errorBruno Schaatsbergen
10/23/2023, 1:23 PMto just overwrite it if you want to
s
Simon Heather
10/23/2023, 1:26 PMThat would be a breaking change on the current functionality though. I don't know why when the pre workflow hook was added, it wasn't made to fail the whole workflow on error...
I added the
fail-on-pre-workflow-hook-errorr
RB
10/23/2023, 1:37 PMOh interesting. Thanks for the background simon.
RB
10/23/2023, 1:38 PMThat might be a good thing to document beside the flag on the runatlantis website for future askers
s
Simon Heather
10/23/2023, 1:55 PMIt is already documented here: https://www.runatlantis.io/docs/pre-workflow-hooks.html#usage
r
RB
10/23/2023, 2:01 PMI need to read the docs then haha. Thank you!
2 Views