https://github.com/alexott/tfsec-databricks
Custom checks for tfsec for Databricks-related resources
https://github.com/alexott/tfsec-databricks
databricks security terraform
Last synced: 5 months ago
JSON representation
Custom checks for tfsec for Databricks-related resources
- Host: GitHub
- URL: https://github.com/alexott/tfsec-databricks
- Owner: alexott
- License: mit
- Created: 2022-08-19T11:59:24.000Z (almost 4 years ago)
- Default Branch: main
- Last Pushed: 2024-12-01T14:57:39.000Z (over 1 year ago)
- Last Synced: 2025-04-13T08:47:38.229Z (about 1 year ago)
- Topics: databricks, security, terraform
- Homepage:
- Size: 10.7 KB
- Stars: 1
- Watchers: 2
- Forks: 0
- Open Issues: 3
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# tfsec custom checks for Databricks-related resources
This repository has a number of the [tfsec](https://github.com/aquasecurity/tfsec) checks (security, costs tracking & optimization, ...) for Databricks-related resources:
- [Azure Databricks resource](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/databricks_workspace) in the `azurerm` provider.
- Different resources of [Databricks Terraform provider](https://registry.terraform.io/providers/databricks/databricks/latest/docs) - clusters, SQL warehouses, jobs, ...
## Usage
1. Install `tfsec` as described in the [documentation](https://aquasecurity.github.io/tfsec/latest/guides/installation/).
1. Clone this repository.
1. Switch to the folder with your Terraform code & execute following command:
```sh
tfsec --custom-check-dir "" .
```
You can always see `tfsec-databricks` in action by running it on the provided examples:
1. Switch into `examples` directory of the cloned repository.
1. Run following command:
```sh
tfsec --custom-check-dir $(pwd)/.. .
```
## Future work
### check that we have AWS VPC endpoints for s3, sts, kinesis-streams
[doc](https://registry.terraform.io/providers/databricks/databricks/latest/docs/resources/mws_vpc_endpoint)
```hcl
resource "aws_vpc_endpoint" "s3" {
vpc_id = module.vpc.vpc_id
route_table_ids = module.vpc.private_route_table_ids
service_name = "com.amazonaws.${var.region}.s3"
depends_on = [module.vpc]
}
```