cmd

Documentation

Index

• Constants
• Variables
• func CacheTransform(key string) *diskv.PathKey
• func DisplayTerraformPlanChanges(tf *tfexec.Terraform, data tfPlanChangesSummary) (bool, error)
• func Execute() (err error)
• func GenerateMarkdownDocs(location string) error
• func InverseCacheTransform(pathKey *diskv.PathKey) string
• func IsDefault(isDefault int) string
• func LocateOrInstallTerraform(forceInstall bool, workingDir string) (*tfexec.Terraform, error)
• func NewDefaultState() *cliState
• func NewVulnerabilityPolicyError(assessment api.VulnerabilityAssessment, failOnSeverity string, ...) *vulnerabilityPolicyError
• func SurveyMultipleQuestionWithValidation(questions []SurveyQuestionWithValidationArgs, checks ...bool) error
• func SurveyQuestionInteractiveOnly(question SurveyQuestionWithValidationArgs) error
• func TerraformExecApply(tf *tfexec.Terraform) error
• func TerraformExecPlan(tf *tfexec.Terraform) (*tfPlanChangesSummary, error)
• func TerraformExecutePreRunCheck(outputLocation string) (bool, error)
• func TerraformInit(tf *tfexec.Terraform) error
• func TerraformPlanAndExecute(workingDir string) error
• type AgentHost
• type AgentsResponse
• type AwsGenerateCommandExtraState
• type Honeyvent
  • func (e *Honeyvent) AddFeatureField(key string, value interface{})
• type OS
• type SurveyQuestionWithValidationArgs
• type TerraformVersion

Constants

const (
	// DisableTelemetry is an environment variable that can be used to
	// disable telemetry sent to Honeycomb
	DisableTelemetry = "LW_TELEMETRY_DISABLE"

	// HomebrewInstall is an environment variable that denotes the
	// install method was via homebrew package manager
	HomebrewInstall = "LW_HOMEBREW_INSTALL"
)

const (
	AzureCloudEnv = "POWERSHELL_DISTRIBUTION_CHANNEL"
)

Env variables found in GCP, AWS and Azure cloudshell. Used to determine if cli is running on cloudshell.

const ConfigBackupDir = "cfg_backups"

The name of the directory we will store backups of configuration files before migrating them

const MaxCacheSize = 1024 * 1024 * 1024

Variables

var (
	QuestionRunTfPlan            = "Run Terraform plan now?"
	QuestionUsePreviousCache     = "Previous IaC generation detected, load cached values?"
	GenerateAwsCommandState      = &aws.GenerateAwsTfConfigurationArgs{}
	GenerateAwsExistingRoleState = &aws.ExistingIamRoleDetails{}
	GenerateAwsCommandExtraState = &AwsGenerateCommandExtraState{}
	ValidateSubAccountFlagRegex  = fmt.Sprintf(`%s:%s`, AwsProfileRegex, AwsRegionRegex)
	CachedAssetIacParams         = "iac-aws-generate-params"
	CachedAssetAwsExtraState     = "iac-aws-extra-state"
)

var (
	// Define question text here so they can be reused in testing
	QuestionEnableConfig                = "Enable Config Integration?"
	QuestionEnableCloudtrail            = "Enable Cloudtrail Integration?"
	QuestionAwsRegion                   = "Specify the AWS region to be used by Cloudtrail, SNS, and S3:"
	QuestionConsolidatedCloudtrail      = "Use consolidated Cloudtrail?"
	QuestionUseExistingCloudtrail       = "Use an existing Cloudtrail?"
	QuestionCloudtrailExistingBucketArn = "Specify an existing bucket ARN used for Cloudtrail logs:"
	QuestionForceDestroyS3Bucket        = "Should the new S3 bucket have force destroy enabled?"
	QuestionExistingIamRoleName         = "Specify an existing IAM role name for Cloudtrail access:"
	QuestionExistingIamRoleArn          = "Specify an existing IAM role ARN for Cloudtrail access:"
	QuestionExistingIamRoleExtId        = "Specify the external ID to be used with the existing IAM role:"
	QuestionPrimaryAwsAccountProfile    = "Before adding subaccounts, your primary AWS account profile name must be set; which profile should the main account use?"
	QuestionSubAccountProfileName       = "Supply the profile name for this additional AWS account:"
	QuestionSubAccountRegion            = "What region should be used for this account?"
	QuestionSubAccountAddMore           = "Add another AWS account?"
	QuestionSubAccountReplace           = "Currently configured AWS subaccounts: %s, replace?"
	QuestionConfigAdvanced              = "Configure advanced integration options?"
	QuestionAnotherAdvancedOpt          = "Configure another advanced integration option"
	QuestionCustomizeOutputLocation     = "Provide the location for the output to be written:"

	// select options
	AdvancedOptDone        = "Done"
	AdvancedOptCloudTrail  = "Additional Cloudtrail options"
	AdvancedOptIamRole     = "Configure Lacework integration with an existing IAM role"
	AdvancedOptAwsAccounts = "Add additional AWS Accounts to Lacework"
	AdvancedOptLocation    = "Customize output location"

	// original source: https://regex101.com/r/pOfxYN/1
	AwsArnRegex = `` /* 154-byte string literal not displayed */
	// regex used for validating region input; note intentionally does not match gov cloud
	AwsRegionRegex  = `(us|ap|ca|cn|eu|sa)-(central|(north|south)?(east|west)?)-\d`
	AwsProfileRegex = `([A-Za-z_0-9-]+)`
)

var (
	// HoneyApiKey is a variable that is injected at build time via
	// the cross-platform directive inside the Makefile, this key is
	// used to send events to Honeycomb so that we can understand how
	// our customers use the Lacework CLI
	HoneyApiKey = "unknown"

	// HoneyDataset is the dataset in Honeycomb that we send tracing
	// data this variable will be set depending on the environment we
	// are running on. During development, we send all events and
	// tracing data to a default dataset.
	HoneyDataset = "lacework-cli-dev"
)

var (
	// All the following "unknown" variables are being injected at
	// build time via the cross-platform directive inside the Makefile
	//
	// Version is the semver coming from the VERSION file
	Version = "unknown"

	// GitSHA is the git ref that the cli was built from
	GitSHA = "unknown"

	// BuildTime is a human-readable time when the cli was built at
	BuildTime = "unknown"

	// The name of the version cache file needed for daily version checks
	VersionCacheFile = "version_cache"
)

var SupportedPackageManagers = []string{"dpkg-query", "rpm"} // @afiune can we support yum and apk?

Functions

func CacheTransform

func CacheTransform(key string) *diskv.PathKey

func DisplayTerraformPlanChanges

func DisplayTerraformPlanChanges(tf *tfexec.Terraform, data tfPlanChangesSummary) (bool, error)

used to display the results of a plan

returns true if apply should run, false to exit

func Execute

func Execute() (err error)

Execute adds all child commands to the root command and sets flags appropriately. This is called by main.main(). It only needs to happen once to the rootCmd.

func GenerateMarkdownDocs

func GenerateMarkdownDocs(location string) error

func InverseCacheTransform

func InverseCacheTransform(pathKey *diskv.PathKey) string

func IsDefault

func IsDefault(isDefault int) string

func LocateOrInstallTerraform

func LocateOrInstallTerraform(forceInstall bool, workingDir string) (*tfexec.Terraform, error)

Determine if terraform is installed, if that version is new enough, and if not install a new ephemeral binary of the correct version into tmp location

forceInstall: if set always install ephemeral binary

func NewDefaultState

func NewDefaultState() *cliState

NewDefaultState creates a new cliState with some defaults

func NewVulnerabilityPolicyError

func NewVulnerabilityPolicyError(
	assessment api.VulnerabilityAssessment,
	failOnSeverity string, failOnFixable bool,
) *vulnerabilityPolicyError

func SurveyMultipleQuestionWithValidation

func SurveyMultipleQuestionWithValidation(questions []SurveyQuestionWithValidationArgs, checks ...bool) error

Prompt for many values at once

checks: If supplied check(s) are true, questions will be asked

func SurveyQuestionInteractiveOnly

func SurveyQuestionInteractiveOnly(question SurveyQuestionWithValidationArgs) error

Prompt use for question, only if the CLI is in interactive mode

func TerraformExecApply

func TerraformExecApply(tf *tfexec.Terraform) error

Run terraform apply using the workingDir from *tfexec.Terraform

- Run plan - Get plan file details (returned)

func TerraformExecPlan

func TerraformExecPlan(tf *tfexec.Terraform) (*tfPlanChangesSummary, error)

Run terraform plan using the workingDir from *tfexec.Terraform

- Run plan - Get plan file details (returned)

func TerraformExecutePreRunCheck

func TerraformExecutePreRunCheck(outputLocation string) (bool, error)

func TerraformInit

func TerraformInit(tf *tfexec.Terraform) error

func TerraformPlanAndExecute

func TerraformPlanAndExecute(workingDir string) error

Execute a terraform plan & execute

Types

type AgentHost

type AgentHost struct {
	MachineHostname string `json:"MACHINE_HOSTNAME"`
	Name            string `json:"NAME"`
	MachineIP       string `json:"MACHINE_IP_ADDR"`
	Status          string `json:"STATUS"`
	//CreatedTime     int64       `json:"CREATED_TIME"`
	AgentVersion string      `json:"AGENT_VERSION"`
	Mode         string      `json:"MODE"`
	Tags         machineTags `json:"TAGS"`
}

type AgentsResponse

type AgentsResponse struct {
	Data []AgentHost `json:"data"`
	Ok   bool        `json:"ok"`
}

type AwsGenerateCommandExtraState

type AwsGenerateCommandExtraState struct {
	Output                string
	UseExistingCloudtrail bool
	AwsSubAccounts        []string
}

type Honeyvent

type Honeyvent struct {
	Version       string      `json:"version"`
	CfgVersion    int         `json:"config_version"`
	Os            string      `json:"os"`
	Arch          string      `json:"arch"`
	Command       string      `json:"command,omitempty"`
	Args          []string    `json:"args,omitempty"`
	Flags         []string    `json:"flags,omitempty"`
	Account       string      `json:"account,omitempty"`
	Subaccount    string      `json:"subaccount,omitempty"`
	Profile       string      `json:"profile,omitempty"`
	ApiKey        string      `json:"api_key,omitempty"`
	Feature       string      `json:"feature,omitempty"`
	FeatureData   interface{} `json:"feature.data,omitempty"`
	DurationMs    int64       `json:"duration_ms,omitempty"`
	Error         string      `json:"error,omitempty"`
	InstallMethod string      `json:"install_method,omitempty"`

	// tracing data for multiple events, this is useful for specific features
	// within the Lacework CLI such as daily version check, polling mechanism, etc.
	TraceID  string `json:"trace.trace_id,omitempty"`
	SpanID   string `json:"trace.span_id,omitempty"`
	ParentID string `json:"trace.parent_id,omitempty"`
}

Honeyvent defines what a Honeycomb event looks like for the Lacework CLI

func (*Honeyvent) AddFeatureField

func (e *Honeyvent) AddFeatureField(key string, value interface{})

type OS

type OS struct {
	Name    string
	Version string
}

type SurveyQuestionWithValidationArgs

type SurveyQuestionWithValidationArgs struct {
	Prompt survey.Prompt
	// Supplied checks can be used to validate IF the question should be asked
	Checks   []*bool
	Response interface{}
	Opts     []survey.AskOpt
	Required bool
}

type TerraformVersion

type TerraformVersion struct {
	Version string `json:"terraform_version"`
}