scoutsuite.yml

name: ScoutSuite
on:
    pull_request:
        branches:
            ["main"]
    push:
        branches:
            ["main"]

jobs:
    terraform-plan:
        name: "Terraform Plan"
        strategy:
            matrix: { dir: ["samples/simple-build-pipeline"] }
        environment: aws-ci
        runs-on: ubuntu-latest
        defaults:
            run:
                working-directory: ${{ matrix.dir }}
        permissions:
            id-token: write
            contents: read
        steps:
            - name: Checkout
              uses: actions/checkout@v4
            - name: Configure AWS Credentials
              uses: aws-actions/configure-aws-credentials@v4
              with:
                aws-region: ${{ vars.AWS_REGION }}
                ## the following creates an ARN based on the values entered into github secrets
                role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
                role-session-name: CGDToolkitGitHubActions
            - name: Setup Terraform
              uses: hashicorp/setup-terraform@v3

            - name: Terraform Init
              id: init
              run: terraform init

            - name: Terraform fmt
              id: fmt
              run: terraform fmt -check
              continue-on-error: true

            - name: Terraform Validate
              id: validate
              run: terraform validate -no-color
            
            - name: Terraform Plan
              id: plan
              run: |
                terraform plan -detailed-exitcode -no-color -var="fully_qualified_domain_name=${{ secrets.CI_FULLY_QUALIFIED_DOMAIN_NAME }}" -out tf.plan
            
            - name: Publish Terraform Plan
              if: steps.plan.outcome == 'success'
              uses: actions/upload-artifact@v4
              with:
                name: tfplan
                path: ${{matrix.dir}}/tf.plan

    terraform-apply:
        name: "Terraform Apply"
        strategy:
            matrix: { dir: ["samples/simple-build-pipeline"] }
        defaults:
            run:
                working-directory: ${{ matrix.dir }}
        runs-on: ubuntu-latest
        needs: terraform-plan
        environment: aws-ci
        permissions:
            id-token: write
            contents: read
        steps:
            - name: Checkout
              uses: actions/checkout@v4
            
            - name: Configure AWS Credentials
              uses: aws-actions/configure-aws-credentials@v4
              with:
                aws-region: ${{ vars.AWS_REGION }}
                ## the following creates an ARN based on the values entered into github secrets
                role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
                role-session-name: CGDToolkitGitHubActions
            
            # Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token
            - name: Setup Terraform
              uses: hashicorp/setup-terraform@v3

            # Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
            - name: Terraform Init
              run: terraform init
            
              # Download saved plan from artifacts  
            - name: Download Terraform Plan
              uses: actions/download-artifact@v4
              with:
                name: tfplan
                path: ${{matrix.dir}}/tf.plan
            
            - name: Examine TF Plan
              shell: bash
              run: |
                  ls -la tf.plan
            
            # Terraform Apply
            - name: Terraform Apply
              run: terraform apply -auto-approve tf.plan

    scout-suite:
        name: ScoutSuite
        runs-on: ubuntu-latest
        strategy:
            matrix: { dir: ["samples/simple-build-pipeline"] }
        environment: aws-ci
        needs: terraform-apply
        permissions:
            id-token: write
            contents: read
        steps:
            - name: Configure AWS Credentials
              uses: aws-actions/configure-aws-credentials@v4
              with:
                aws-region: ${{ vars.AWS_REGION }}
                ## the following creates an ARN based on the values entered into github secrets
                role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
                role-session-name: CGDToolkitGitHubActions

            - name: Setup Python
              uses: actions/setup-python@v5
              with:
                python-version: "3.10"

            - name: Install ScoutSuite
              run: pip install scoutsuite

            - name: Run Scout
              run: python3 scout.py aws

    terraform-destroy:
        name: "Terraform Destroy"
        strategy:
            matrix: { dir: ["samples/simple-build-pipeline"] }
        runs-on: ubuntu-latest
        defaults:
            run:
                working-directory: ${{ matrix.dir }}
        needs: scout-suite
        environment: aws-ci
        permissions:
            id-token: write
            contents: read
        steps:
            - name: Checkout
              uses: actions/checkout@v4
            
            - name: Configure AWS Credentials
              uses: aws-actions/configure-aws-credentials@v4
              with:
                aws-region: ${{ vars.AWS_REGION }}
                ## the following creates an ARN based on the values entered into github secrets
                role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
                role-session-name: CGDToolkitGitHubActions
            
            # Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token
            - name: Setup Terraform
              uses: hashicorp/setup-terraform@v3

            # Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
            - name: Terraform Init
              run: terraform init
            
              # Download saved plan from artifacts  
            - name: Download Terraform Plan
              uses: actions/download-artifact@v4
              with:
                name: tfplan
                path: ${{matrix.dir}}/tf.plan

            - name: Examine TF Plan
              shell: bash
              run: |
                ls -la tf.plan
            
            # Terraform Apply
            - name: Terraform Apply
              run: terraform destroy -auto-approve tf.plan