class Analyzer::Specification::Terraform

Overview

Extracts HTTP endpoints from Terraform / OpenTofu configurations that declare AWS API Gateway routes. Two shapes are covered, mirroring the CloudFormation analyzer:

Both HCL (.tf) and Terraform JSON (.tf.json) inputs are supported.

Defined in:

analyzer/analyzers/specification/terraform.cr

Constant Summary

HTTP_METHODS = {"GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "ANY"}
METHOD_ANY = "ANY"
REF_ATTRS = {"parent_id", "resource_id"}
RESOURCE_TYPE_REST_M = "aws_api_gateway_method"
RESOURCE_TYPE_REST_R = "aws_api_gateway_resource"
RESOURCE_TYPE_V2 = "aws_apigatewayv2_route"
TARGET_ATTRS = {"route_key", "path_part", "parent_id", "resource_id", "http_method"}

Attributes the analyzer reads out of a resource body. Everything else is skipped while scanning.

route_key / path_part / http_method are only meaningful as literal strings — a computed value (each.value.method, "${var.path}") can't be resolved statically, so they are captured from quoted strings only. resource_id / parent_id are by nature references into the resource graph, so they are captured from bare expressions too.

Class Method Summary

Instance Method Summary

Instance methods inherited from class Analyzer

analyze analyze, base_path : String base_path, base_paths : Array(String) base_paths, base_relative_path(path : String) : String base_relative_path, callees_needed? : Bool callees_needed?, content_matches?(content : String, markers : Regex) : Bool content_matches?, http_header_name(name : String) : String | Nil http_header_name, line_number_for_index(content : String, char_index : Int32) : Int32 line_number_for_index, logger : NoirLogger logger, parallel_analyze(files : Array(String), &block : String -> Nil) parallel_analyze, read_file_content(path : String) : String read_file_content, result : Array(Endpoint) result, tech : String tech, unique_params(params : Array(Param)) : Array(Param) unique_params, url : String url, web_root_path(path : String, markers : Array(String)) : String web_root_path

Constructor methods inherited from class Analyzer

new(options : Hash(String, YAML::Any)) new

Macros inherited from class Analyzer

analyzer_for(tech) analyzer_for

Instance methods inherited from module FileHelper

all_files : Array(String) all_files, get_files_by_basename(basename : String) : Array(String) get_files_by_basename, get_files_by_extension(extension : String) : Array(String) get_files_by_extension, get_files_by_extensions(extensions : Array(String)) : Array(String) get_files_by_extensions, get_files_by_prefix(prefix : String) : Array(String) get_files_by_prefix, get_files_by_prefix_and_extension(prefix : String, extension : String) : Array(String) get_files_by_prefix_and_extension, get_files_by_relative_path(relative_path : String, root : String = "") : Array(String) get_files_by_relative_path, get_public_dir_files(base_path : String, folder : String) : Array(String) get_public_dir_files, get_public_files(base_path : String, anchors : Array(String) = ["shard.yml", "Gemfile"]) : Array(String) get_public_files, walked_path(expanded : String) : String walked_path

Class Method Detail

def self.tech_name : String #

[View source]

Instance Method Detail

def analyze #

[View source]
def tech : String #

Instance-side view of the same declaration. The per-file rescues live on this base class, which has no way to name the analyzer that is running inside them, so a skipped file could not be attributed to a tech. Deriving it from analyzer_for keeps the name written exactly once.


[View source]