terraform-docs markdown . --output-file README.md

# https://github.com/terraform-linters/tflint/blob/master/docs/user-guide/module-inspection.md
# borrowed & modified indefinitely from https://github.com/ksatirli/building-infrastructure-you-can-mostly-trust/blob/main/.tflint.hcl

plugin "aws" {
  enabled = true
  version = "0.13.3"
  source  = "github.com/terraform-linters/tflint-ruleset-aws"
}

config {
  module     = false
  force      = false
}

rule "terraform_required_providers" {
  enabled = true
}

rule "terraform_required_version" {
  enabled = true
}

rule "terraform_naming_convention" {
  enabled = true
  format  = "snake_case"
}

rule "terraform_typed_variables" {
  enabled = true
}

rule "terraform_unused_declarations" {
  enabled = true
}

rule "terraform_comment_syntax" {
  enabled = true
}

rule "terraform_deprecated_index" {
  enabled = true
}

rule "terraform_deprecated_interpolation" {
  enabled = true
}

rule "terraform_documented_outputs" {
  enabled = true
}

rule "terraform_documented_variables" {
  enabled = true
}

rule "terraform_module_pinned_source" {
  enabled = true
}

rule "terraform_standard_module_structure" {
  enabled = true
}

rule "terraform_workspace_remote" {
  enabled = true
}

tflint --init
tflint --config=.tflint.hcl --var-file=terraform.tfvars .

tfsec . --tfvars-file terraform.tfvars

infracost breakdown --path . --terraform-plan-flags "-var-file=terraform.tfvars"

driftctl scan

version: "3"

env:
  CONFIG: '{{.CONFIG | default "."}}'

dotenv: [".env", "aws/.env"]

silent: true

tasks:
  banner:
    desc: Banner
    cmds:
      - cowsay $CONFIG  | lolcat
      - echo "✔️  {{.GREETING}} - run 'task -l' for more task list"
      - echo "💻 {{OS}} - {{ARCH}}"

  tfdoc:
    desc: ℹ️ Documentation Task for Terraform
    summary: |
      A utility to generate documentation from Terraform modules in various output formats
    cmds:
      - terraform-docs markdown . --output-file README.md
    ignore_error: true

  access:
    desc: AWS Access with aws-vault
    cmds:
      - aws-vault exec -d 2h gdn-lab --region=eu-central-1

  trunk:
    desc: Trunk
    cmds:
      - task: banner
        vars: { { .CONFIG } }
      - trunk init # ✖ Trunk can only init if it's run at the root of a git repo
      - trunk check -n $CONFIG

  build:
    desc: Terraform Build
    cmds:
      - task: banner
        vars: { { .CONFIG } }
      - terraform -chdir=$CONFIG init
      - terraform -chdir=$CONFIG fmt
      - terraform -chdir=$CONFIG validate
      - terraform -chdir=$CONFIG plan

  deploy:
    desc: Terraform Deploy
    cmds:
      - task: banner
        vars: { { .CONFIG } }
      - terraform -chdir=$CONFIG apply -auto-approve

  destroy:
    desc: Terraform Destroy
    cmds:
      - task: banner
        vars: { { .CONFIG } }
      - terraform -chdir=$CONFIG apply -auto-approve -destroy

  tfcost:
    desc: infracost - Generate cost estimates from Terraform
    cmds:
      - infracost breakdown --usage-file infracost-usage.yml --path . --terraform-plan-flags "-var-file=terraform.tfvars"

  tflint:
    desc: tflint - A Pluggable Terraform Linter
    dir: $STACK
    cmds:
      - tflint --init
      - tflint --config=.tflint.hcl --var-file=terraform.tfvars .

  tfsec:
    desc: tfsec - a simple tool to detect potential security vulnerabilities in your terraformed infrastructure.
    dir: $STACK
    cmds:
      - tfsec . --tfvars-file terraform.tfvars

  tfdrift:
    desc: ℹ️ Catch infrastructure drift
    summary: |
      driftctl is a free and open-source CLI that warns of infrastructure drift and fills in the missing piece in your DevSecOps toolbox.
    cmds:
      - driftctl scan
    ignore_error: true