Project: Terrascan (Provisioning / Security & Compliance)
File: CHANGELOG.md

Merged pull requests: update net deps to fix vuln () Merged pull requests: fix openssl-libcrypto1.1@1.1.1u-r1 library vulnerability () Increased timeout for webhook test () only high vulns detected by docker scan fixed () remove k8s admission log UI () Spelling () Merged pull requests: bugfix: provider version coming as 0.0.0 or empty () Bump github.com/docker/docker from 20.10.21+incompatible to 20.10.24+incompatible () deprecate k8s admission log UI (Snyk test) () added sonar-properties file to skip tests from sonar analysis () Closed issues: AC\DOCKER\0041 Issues accurics.gcp.IAM.145 triggers for GitHub repos imageVersionnotusinglatest and AC\DOCKER\0041 Issue Inconsistent notation for severity in output \(sometimes uppercase, sometimes not\) Merged pull requests: Bump github.com/aws/aws-sdk-go from 1.43.16 to 1.44.193 () Bump google.golang.org/api from 0.103.0 to 0.109.0 () Fix description and version rule () APE-11967 : error due to new attribute in terraform cause all other working module and resources to be ignored () Consolidate spelling of severity levels to all uppercase LOW/MEDIUM/HIGH () Remove wrongly placed github\_repository policy from gcp folder () APE-8064 - Support one or more values.yaml file as an input to helm scan () Merged pull requests: \ () added tar.gz archive for windows () Update opa and cobra version () ignored matching provider version in tests () added terraform and provider version in resource config () Bump github.com/hashicorp/go-getter from 1.5.11 to 1.6.2 () Implemented enhancements: refs resolution () bump goformation from v6 to v7 () update cft map for elb and s3 bucket () Include DirScanErrors info in SARIF file () Merged pull requests: fix remote source url () Update object.get first parameter () Update/release command () updated terrascan version in deployment scripts () Implemented enhancements: JSON Output has Logs for Standard Error Malformed output after a parsing error update rds instance cft map () update libraries () Closed issues: installation error Calling attention to your documentation... Docs don't mention pre-requirements resource ID has an invalid format Dockerfile Error message scanning IaC Types False positive with AWS provider \>=4.x style bucket resources Merged pull requests: Update RDS Policies () Add Terrascan Sandbox link to README () allow host policy update () Policy IDs update () vuln tests () Mention pre-requirements in the README () fixed typo of the function name () Add github-actions to dependabot () adding PITR attribute mapping config for dyanmodb () container funcs to return dev friendly warnings () \ () Add iac providers endpoint () updated policy for kubernetes () Update README.md () Closed issues: Export Windows files in release using zip extension Merged pull requests: Adding CFT support for new resources () fixes: panic in case of zap logger init on windows os () Closed issues: Export Windows files in release using zip extension Merged pull requests: fixes: panic in case of zap logger init on windows os () Merged pull requests: Support reading .terraformrc file from env var () CFT lambda conversion nil pointer check to avoid panic () Fix descriptions to install terrascan () Rebranding repository to Tenable brand () Rebranding to Tenable () Update README.md () fix: remove master ref check from release docker push job () Fixed bugs: Issue with Terrascan and CloudFormation Closed issues: Terrascan 1.13.2 version uses go 1.16.14 version which has High vulnerability. When can we expect the release with go version 1.17? Merged pull requests: Update Docker () Update mkdocs-material to 8.2.14 () Fix panic while scanning cloudformation templates () Bump alpine from 3.14.6 to

in /build () Removing workflow file () Bump github.com/hashicorp/go-getter from 1.5.7 to 1.5.11 () file out writer implementation () mark ecr e2e test pending () Add dep scan () Update alpine version () support for new flag to define custom temp directory () Use Docker buildx for multi-platform support () Implemented enhancements: \ () Feature/endpoint policy download () Feature/best effort cft file load () Fixed bugs: update lambda function mapper () remove undefined template variable () Closed issues: Terrascan creates ~/.terrascan even though policy directory is supplied Terrascan 1.13.2 version uses go 1.16.14 which has High vulnerability. When is the release with go 1.17 version expected? Blocks of type "moved" not supported Intermittent error running terrascan - rego\parse\error: unexpected assign token: non-terminated set cli/run.go:110 scan run failed{error 26 0 failed to initialize OPA policy engine} Can't parse Terraform variable field: `nullable` AC\AWS\0214 not backward compatible azurerm\key\vault\_secret error not in line with tests Support AWS Terraform provider v4 for S3 buckets Merged pull requests: terraform iac provider should proceed with static analysis when rootMod is not `nil` () skip policy download if -p flag used () Update README.md () Update mkdocs to 1.3.0 () remove source\code\hash mapping () Adds: dir scan errors in human readable output format () Update mkdocs-material to 8.2.6 () add CODEOWNERS for terrascan () Adds: git in container which is required for go build () typo: Change "desitnation" to "destination". () Add security policy () skip vuln test for dependabot () Perform: go mod tidy () updating s3 bucket policies for v4 aws provider () Add backward compatible implementation of AC\AWS\0214 () fix: reworded error to explain tests performed () Bump go 1.17 () Implemented enhancements: Feature/s3 policy update () Fixed bugs: Bugfix/coginto pool () Closed issues: Is it possible to use terrascan in an offline environment Support AWS provider version 4.0.0 False positives and false negatives - AC\AWS\0215 / AWS.S3Bucket.DS.High.1043 False positive: AWS.RDS.DataSecurity.High.0414 / AC\AWS\0058 AC\GCP\0014 \(dnsStateIsNotOn\) false positive Merged pull requests: skip terrascan init for --config-with-error flag () Bugfix/s3 user policy () fix rds encryption check policy () Update mkdocs-material to 8.2.1 () Adds: missing release tag push step () Adding CFT scanning support for the resources: () Implemented enhancements: update cft mapper () update cft mapper () Feature/eks msk vpc version () Feature/rds sage dms load emr msk () Feature/ec2 cog lambda acm cft () Updates CloudFormation mapper to support additional resources () Closed issues: Issue with skipped violations using CircleCI and JUnit output format Merged pull requests: Add Policy AC\GCP\0296 - Service Attachment with ACCEPT\_AUTOMATIC () fix panic in cft () Fixes failing docker IaC provider test () \ () Update mkdocs-material to 8.1.10 () Fix typos in docs and release\_checklist () add rule id to docs () add ability to output normalized resource config with errors () Update mkdocs-material to 8.1.9 () Allow internal github repos to pass AC\GCP\0231 & AC\GITHUB\0002 () Update mkdocs-material to 8.1.8 () Prevent adding both skipped and failure elements () Updated discord link in readme () Adds: logger in case of flag parsing fails () Update README.md () Fix gcp policy AC\GCP\0014 - dnsStateIsNotOn \(\#1033\) () Allow tfplan format version 0.2 () Closed issues: AC\DOCKER\0001 Trigger for no reason Rule ID mismatch for \#ts:skip annotation Merged pull requests: Update mkdocs-material to 8.1.4 () fix input CFT templates based on goformation structs () Update mkdocs-material to 8.1.3 () Update mkdocs-material to 8.0.5 () fix: update go mod to add missing dependencies () Update mkdocs-material to

() fix: handles nil pointer while extracting container images () Update mkdocs-material to 7.3.6 () updating policies to detect cve-2021-25742 () Fix Sarif file uri path invalid in Windows and update go-sarif to latest () New k8s policy to detect CVE-2021-25742 () making change in imageVersionnotusinglatest.rego () Fixed bugs: A scan should NOT crash if the notification doesn't work as expected Rotation period for KMS keys not correctly interpreted \(GCP\) Closed issues: pre-commit hook reporting error with terrascan Terrascan: Not working in a Repository referencing other repository vulnerabilities found in accurics/terrascan\_atlantis image Merged pull requests: Update mkdocs-material to 7.3.4 () Add support for repo-url and branch name in CLI flags and scan output () Update mkdocs to 1.2.3 () Update mkdocs-material to 7.3.3 () Add support for getting line numbers for all attributes () Update atlantis base image () Fix notification webhook flow () update container image version in helm and kustomize sources () Accept notification webhook configs as CLI args () Implemented enhancements: How to ignore rules onto whole module included into HCL file Adds: support for harbor registry vulnerability fetching () Fixed bugs: panic: value is null Closed issues: helm chart breaking due to invalid configfile name extension Merged pull requests: Fix \#1046: helm chart breaking due to invalid configfile name extension () fix permission issues in creating webhook mode logs file persistence () Update mkdocs-material to 7.3.2 () accepted 2xx in response code as success () Optimized disk encryption check code on the azurerm\managed\disk resource () Update docs for AWS.LambdaFunction.Logging.Low.0472 policy () fix: added null check before value conversion to avoid panic () Update mkdocs-material to 7.2.6 () Update README.md () Adds: e2e tests for vulnerability () Adds additional dockerfile policies () Implemented enhancements: Add capability to extract references to container images in K8s ecosystem IaC Fixed bugs: Terrascan does not exit with error code in pipeline or CLI Closed issues: Links are Not formatted Properly in Contributor Doc Enabling dependabot or renovate for automatic dependency update AC\K8S\0131 triggers on a Namespace resource Integrity issue with Kustomize v4 support Add Support For ECR Add capability to extract references to container images in terraform Kustomize support says v3 but is actually v4 Merged pull requests: Extract images from Dockerfiles () Revert "update resource type to map\ () Upgrade helm.sh/helm/v3 to version 3.6.1 () Bump github.com/pelletier/go-toml from 1.8.1 to 1.9.3 () Adds additional policies for dockerfile () terrascan should exit with non zero exit code when scan error are present () Bump github.com/hashicorp/go-getter from 1.5.2 to 1.5.7 () update resource type to map\ () docs: fixes links in contributing documentation () Initial support for image scanning () added binary based support for kustomize v2 and v3 () Docs: adds brew instructions to release checklist () Update mkdocs-material to 7.2.4 () modify wait logic for service account creation in e2e validating webhook test () Update mkdocs-material to 7.2.3 () Bump github.com/hashicorp/hcl/v2 from 2.10.0 to 2.10.1 () Bump github.com/spf13/afero from 1.5.1 to

() Adds: e2e test for docker IaC provider () Fix dependency issue that caused dependabot to fail () fix\(policies\): removing false-positive for K8s namespaces () Extract Docker images from Terraform templates () Fixes supported Kustomize version \(should be v4\) () Extract Docker images from k8s YAML files () Implemented enhancements: Dockerfile Support pre-commit hook Add support for CFT nested stacks Adds support for using Terraform modules cached locally Fixed bugs: Helm chart scans use only 4 policies Closed issues: Link to docks in README Ensure remote modules are downloaded only once Rule suppression for specific resources Merged pull requests: Fixes k8s policy filtering () Update mkdocs-material to 7.2.2 () Adds Terrascan pre-commit () Add support for CFT nested stacks () fix - remote repo scan with config only option generates panic () Update mkdocs-material to 7.2.1 () Update README.md () Update helm chart progress checklist () Adds support for using Terraform modules cached locally () Update mkdocs-material to 7.2.0 () Dockerfile support () Closed issues: terrascan init should not be triggered if the user only wants to generate normalised json. No rules are processed in GitlabCI Scanning remote modules doesn't have same results as for scanning Terraform plan itself Module AWS.KMS.Logging.High.0400 seems to serve no purpose Secure ciphers are not used in CloudFront distribution Correct point in time recovery for DynamoDB still leads to violation Merged pull requests: fix go mod files () Update mkdocs-material to 7.1.11 () Update mkdocs to 1.2.2 () K8s Policy to detect a service type Loadbalancer without a selector () Fix \#926: Do not initiate policy engine incase of --config-only flag () Update mkdocs-material to 7.1.10 () fix\(sws/cloudfront\): wrong check tls version () fixes: broken doc links () update getting started and Usage, fix links () Update overview.md () Remove unnecessary KMS deletion window code () minor-doc-fix () fix confusing error log message () add integrations overview and minor fixes () Updating the dax cluster policy () add github-sarif writer for github suited sarif output () Add support for arm linked templates () terraform 0.15 support () Implemented enhancements: Add Support for new reference id field Fixed bugs: Sarif output has wrong file path value for file scans 'k8s' key updated multiple times in policy package Closed issues: Terrascan is failing in scan Refactor to Disable CGO Issue on Azure Pipelines: failed to initialize terrascan 1.7.0 Can't skip rules with underscore Recursive Loop Scanning Terraform Improve filenames in remote modules Issues running terrascan in azure pipelines Merged pull requests: fix error messages reported from hcl diags () add in-file instrumentation segment () Minor documentation fixes () Use CGO independent package for sqlite () GH action doc - fix code block () Update cicd-fix code block.md () fixes: recursive loop when parent and child module has same local block () Update mkdocs-material to 7.1.9 () Updates documentation on Terrascan github action () fix usage overview links.md () Split usage docs () add proper values via metadata () Update mkdocs to 1.2.1 () Update Integration Docs.md () k8s policies refactor () mod azure policies to improve parity with siac () Fix authorization header for http request () Adding Id fix for github policies () Bugfix/k8s id field () Add ID Field in Azure Policies () adding ID field for aws policies () Adding missing Id field for GCP policies () Updating network security policies for GCP () improves: filename in remote module () Adding AWS Network Security Policies () Change api, Add support for s3 bucket resource and better cft loader () Fixes incorrect filepath reporting in sarif output & added e2e tests for sarif output () Bugfix/az nw sec policies () Update mkdocs-material to 7.1.8 () Fix AC\AZURE\0185 policy () fixed sarif unit tests hardcoding code smell () fix broken link to

() Added "id" field support & policy validation tests () Add Microsoft Azure ARM as an IaC Provider () Implemented enhancements: Enhancement: Support sarif as output format Admission Controller e2e tests Enhance terrascan docker to support all terrascan run modes Config file changes for server and admission controller Create Helm charts for the terrascan admission webhook setup. Enhancement: Use module instance name for download directory Fixed bugs: Azure AKS failing to check the network policy status. Scan for terraform doesn't error out if a module definition refers to a directory with no tf files Wrong detection of MemoryRequestsCheck,CpuRequestsCheck,noReadinessProbe and nolivenessProbe policy in k8s Job spec Update Docker build for terrascan to use numeric UID Wrong detection of AllowPrivilegeEscalation \(policy AC-K8-CA-PO-H-0165\) in K8s pod spec Failed to run prepared query error in opa/engine.go tfplan should use resource address for id field Rule IDs with spaces cannot be skipped AWS.CloudFront.Network Security.Low.0568 Doesn't allow skipping due to space in filename Error parsing syntax if using complex query for dynamic ip\restriction in azurerm\function\app or azurerm\app\_service resource Closed issues: Add support for YAML format for terrascan config file Add ID field Add a middleware to log incoming http\(s\) requests on terrascan server terrascan server: validation missing for --cert-path and --key-path show-passed should report passes only for the existing resources Out of the box handling of certificates in helm charts for terrascan in Server mode In-file Instrumentation Release 1.5.2 or 1.6.0 Issue in GCP Policyfile unrestrictedRdpAccess.rego accurics.azure.AKS.3 is defective Rule `lambdaNotEncryptedWithKms` should not check for KMS when env vars are not being used Terrascan does not resolve env var for aws\rds\cluster attribute storage\_encrypted Valid Terraform configuration fails with `s3EnforceUserAcl` kmsKeyExposedPolicy:22: eval\builtin\error: json.unmarshal: invalid character '$' looking for beginning of value} Terrascan not able to find terraform config files in a sub directory, but it works in case of k8s infrastructure type Potential nil-dereference found while fuzzing terrascan should have a `category-list` command Improved Documentation Improve test coverage for k8s Merged pull requests: Fixing the bug for google\kms\crypto\_key policies () Fix AWS dynamo Db policy for point in time recovery () Bugfix/use ref id old format () reference ids with & and \<space\> fixed () fixes: Terraform inner block reference resolution () Bump up to Go/1.16 () \ () Support for spaces in policy reference\_id () fix - type assertion check for

in terraform iac provider () Add ID Field for AWS Policies' Metadata () Policy to check CVE-2021-25737 () Enhancing AWS policies () aws s3 policy `s3EnforceUserAcl` update () add check for env vars and kms () Add ID Field for K8s Policies' Metadata () Do not trim resource id from tfplan json () Add ID Field for GCP Policies' Metadata () fix - source path for k8s file scan is absolute () added pending test changes for config reader () fix: moves the pending test to running () fix multierror variable issue () \ () add support for YAML format for terrascan config file () Add AWS CFT as an IaC Provider () fix failing e2e test () Adding Aws new policies cloudTrail () Feature/az id field () added support for sarif formatted violation reports () Adds support to scan config resources with applicable policies & Refactors filtration () Adds: in-file instrumentation for resource prioritizing () shifted opa engine warning message to debug log level () fix: added validation for module local source dir () policy metadata changes to include `policy\type` and `resource\type` () Fix pod level securityContext support () Fix policy code for securityContext and Probes () add logging middleware for server () config file changes for terrascan server () Automate generation of TLS Certs using Helm () Add webhook setup capability and remote repo scan capability in the helm charts () Changed description of policy file to match port. () Added source\_range 0.0.0.0/0 \(any\) to avoid rule violations () support for `module name` in violation summary () Modified the Dockerfile to use numeric UID () adds e2e tests for validating webhook () add validation for tls private key and cert file values () Documentation () change docs to include docker subcommands.md () shifted custom atlantis container source under integrations/ directory () Update mkdocs-material to 7.1.4 () Add a kustomize based guide for setting up terrascan server and validating webhook in kubernetes () Fix accurics.azure.AKS.3 () Update mkdocs-redirects to 1.0.3 () Initial addition of terrascan helm chart () Implemented enhancements: Atlantis Integration Enhancement: support for all iac scan for cli Feature request: scan sub-folders too Fixed bugs: Admission Controller Doesn't display feedback for kubectl "create" and "apply" Closed issues: GKE Control Plane is exposed to few public IP addresses Error with finding Enable AWS CloudWatch Logs for APIs Task: Add to github actions ability to build/push terrascan\_atlantis image accurics.azure.NS.161 does not work with tfplan terrascan "latest" docker image broken for tfplan Local expansion recursive infinite loop Merged pull requests: Feature/aws new policies sp () Argocd doc volume field modification () Update mkdocs.yml () fix failing test () AWS policy pack update () Adding release checklist () Gh action terrascan\_atlantis release () adds argocd integration dockerfile, scripts, doc and examples () Fix NSG associations () changes for argocd integration () Update admission-controller-webhooks-usage.md () fix - \#718 () doc: add homebrew badge () update version () adds skipped tests for server file scan when file is k8s yaml () fixes infinite loop while local variable resolution () add terrascan atlantis container files, scripts and doc. () adds support to scan directory with all iac providers in cli mode () adds support to scan sub folders for terraform iac provider () Fixed bugs: Recursive loop expanding variables in included module Terrascan doesn't resolve terraform complex variables Panic while resolving floating point variable Terrascan using absolute path for "source" value of resource Failed to initialize terrascan. error : failed to install policies Terrascan not able to read modules within a subdirectory Terrascan init command doesn't work with -c flag Closed issues: Not able to scan repo when google terraform module defined The link referencing the documentation to integrate Terrascan into CI/CD is broken Make saving of "admission request" configurable via an option in the config file for the validating admission webhook Add API\_KEY to the /logs endpoint for the validating admission webhook Panic: not a string unit tests and e2e tests failing on windows Add support for private terraform repos policy not evaluating Terrascan does not support to download modules via SSH terrascan scan fails if path and rego\_subdir are not provided together in the toml configfile Getting error while running scan on our terraform repo Terrascan not found policy id `Policies Violated` and `Violated Policies` are confusing. Invalid categories not being validated from config file Terrascan API server's file scan doesn't work for k8s yaml files Add `/go/bin` to the PATH variable in Docker image terrascan scan command doesn't work with TERRASCAN\_CONFIG env variable Format junit-xml need to have passed test results, not only failed test optimize policy download process in `terrascan init` Merged pull requests: Release

() Adds support to configure dashboard mode in k8s validating webhook () Updating documentation for k8s admission control () Fix recursive variable reference resolution () Update mkdocs-material to 7.1.2 () Fixes broken link in README () Docs- fix argo image path.md () Makes saving of admission requests configurable via a config file option () Add authentication with API key for the /logs endpoint () Fixes docs format () Update mkdocs.yml () Support for authenticated tf module download () Fix - terraform complex variables are not getting resolved () Reorganized and Updated docs () Fix- panic when terraform list variable doesn't have a type () Fix panic for floating point variables () Adding support to scan IAC from atlantis workflow () Fix - k8s resources config data has absolute source paths for resources () Fix - terrascan not able to read modules within a subdirectory () Add /go/bin to PATH. () Update mkdocs-material to 7.1.0 () Fix windows tests () Fix kustomize scan breakage on windows () Update route53LoggingDisabled.rego to ignore private zones () Adding openssh for downloading modules via ssh () Fix - init behavior change () Add support for validating admission webhook in terrascan () Policy download refactor () Update mkdocs-material to 7.0.6 () Log error in LoadIacDir before continuing () K8S Risk Category Changes () GCP Risk Category Changes () Category flag e2e tests () Azure Risk Category Changes () AWS Risk Category Changes () Bugfix/revert policies () Server mode: take file extension from uploaded file () filepath fixes in e2e tests () Update mkdocs-material to 7.0.5 () update helm default chart name and namespace values () v1.4.0 doc updates () Terrascan K8s New categories and ruleRef ID changes () GCP Category Changes () AWS new Categories () New Policies for Azure & Category Updates. () Terrascan init and config handling refactor () Feature: add options to specify desired categories of violations to be reported () Implemented enhancements: Scanning terraform plan files Adds support for junit xml output Adds e2e test scenarios for help and scan command Adds e2e tests for api server Please checkout our new Fixed bugs: Fixed a few bugs in the init command and downloading of fresh policies, including Difference in violated policies for the same terraform file false positive for AWS.Instance.NetworkSecurity.Medium.0506 accurics.gcp.IAM.122 needs to take into account the new name for Uniform bucket-level access flag fix the 'repo already exist' bug and improve error logging for terrascan init () Closed issues: terrascan API server's file scan always returns the resource config Issue on Azure DevOps Agents since 1.3.2 : failed to initialize terrascan Could not get terrascan init to work - would not download policy documents Merged pull requests: release 1.4.0 () adds e2e tests for api server () adds support to use 'config\_only' attribute in api server's file scan () adds support to display passed rules () Update mkdocs-material to 7.0.1 () fix filepaths and home directory lookup () adds e2e test scenarios for help and scan command () Adds support for scanning tfplan json file () fix: renamed the json file to remove spaces () fix: Changed the description message to handle the violation correctly () bump versions to v1.3.3 () updated go module files () Initial changes for e2e testing framework () Add code of conduct () Fixes incorrect description of RDS encryption policy () changes in log level and messages for load iac functions () Update mkdocs-material to 6.2.8 () Updates docs for

() update readme for v1.3.2 () fix - improved description for init command in help () Adds support for junit xml output () enhancement: scan terraform registry modules as remote type () support for terraform registry remote modules () feature: add options to specify desired severity level of violations to be reported () Bump github.com/spf13/cobra from 1.0.0 to 1.1.1 () Fixed bugs: terrascan init should download new policies Closed issues: How to get rid of "Anonymous, public read access to a container and its blobs can be enabled in Azure Blob storage. This is only recommended if absolutely necessary." False Positive for accurics.azure.NS.161 when Security Groups Association and Subnets are defined independently from VNet Calico is not supported as a valid Network Security for azurerm\kubernetes\cluster Merged pull requests: Update readme for v1.3.2 () bump terrascan version to v1.3.2 () refactor init command for robust policy download checks () terrascan init will download new policies. () bugfix: Checks for security group association defined independently from vnet () Update mkdocs-material to 6.2.7 () Fixed typos in docs () Enhancement: new set of policies for AWS EC2 instance. () Harkirat22/bug fix () fixes \#376 () fixes \#405 () Policy/aws launch config () add support for pod container () Update mkdocs-material to 6.2.6 () Update README.md and changelog for 1.3.1 () Implemented enhancements: Support for remote modules Tag container image with release version Fixed bugs: Build error on ARM MacOS terrascan consider source = "terraform-aws-modules/vpc/aws" as local path Failed to read module directory Closed issues: Custom Variable Validation no longer experimental in 0.13 Merged pull requests: release v1.3.1 () fix dependencies that were breaking the darwin/arm64 build () support for terraform registry remote modules () Readme rule suppression () Bump github.com/hashicorp/go-retryablehttp from 0.6.6 to 0.6.8 () Bump github.com/hashicorp/go-getter from 1.5.1 to 1.5.2 () Implemented enhancements: Prints output in human friendly format Support for rule suppression using terraform comments,kubernetes annotations, cli arguments, and config file. New Policies for Kubernetes Tag released Docker images Add policy for checking insecure\ssl configuration for github\repository\_webhook in GitHub provider Introduced support for terraform .14 and .13. Note: This will introduce some breaking changes for terraform v.12 files, even if using --iac-version v.12 flag. Notably we will no longer support multiple providers blocks, and certain references inside provisioner blocks (objects other than self, count or each, where when = destroy) . For more details see: https://github.com/hashicorp/terraform/releases/tag/v0.13.0 Fixed bugs: terrascan doesn't allow registering multiple versions for an iac-type Debug resource lock terrascan panic: not a string False positive for aws rule vpcFlowLogsNotEnabled accurics.GCP.EKM.132 and accurics.GCP.EKM.131 wrong violation using disk\encryption\key s3EnforceUserACL - False Positive How to fix accurics.azure.EKM.20 Why accurics.gcp.IAM.104 suggests enabling a client certificate? Closed issues: terraform can't detect violations in terraform modules uniformBucketEnabled.rego referencing deprecated config Unable to run terrascan scan Terrascan doesn't exit with error on CLI or Parsing errors. Terrascan Failure When Using Terraform 13 + Variable Validation Update policy example in documentation to use latest GitHub implementation Fix link to repo playground in policies documentation terrascan scan crashes with runtime: goroutine stack exceeds 1000000000-byte limit Typo error in the terrascan Architecture page accurics.gcp.OPS.114 should also check for cos\_containerd image accurics.gcp.NS.112 suggest basic auth is enabled when is not Test coverage missing for kustomize iac-provider Why is vpcFlowLogsNotEnabled determined to be a violation? Merged pull requests: update version to v1.3.0 () Add v13 flag option for terraform iac () Fix: potential bug added in PR \#470 () Bump

from 0.7.1 to 0.7.2 () Bump github.com/mattn/go-isatty from 0.0.8 to 0.0.12 () solves issue \#382, and improved policy to relate disk with the instance () solves issue \#331 () Update mkdocs-material to 6.2.5 () Bump go.uber.org/zap from 1.13.0 to 1.16.0 () Bump github.com/spf13/afero from 1.3.4 to 1.5.1 () Bump github.com/iancoleman/strcase from 0.1.1 to 0.1.3 () Bump github.com/hashicorp/go-version from 1.2.0 to 1.2.1 () Bump github.com/pelletier/go-toml from 1.8.0 to 1.8.1 () Policy update 2021 01 14 () fix panic for list variables () adding an else condition to relate management lock with resource group () adding an else condition to relate the flow log with vpc () including a check for verifying in-line policy is included () adding rule to check if waf is enabled at cloud front distribution () Added terraform v14 support besides v12. () support comment with rule skipping for resource and scan summary modifications () recognize metadata.generateName () Update mkdocs-material to 6.2.4 () Update README.md () Deprecated gcs bucket () changed the description to include the vulnerable versions () Fix exit code on error () policy for CVE-2020-8555 () Update README.md () rule skipping for resources in k8s () terrascan argo-cd instructions () Adds CI/CD integration docs () Bump github.com/zclconf/go-cty from 1.2.1 to 1.7.1 () Bump sigs.k8s.io/kustomize/api from 0.6.5 to 0.7.1 () Bump github.com/gorilla/mux from 1.7.4 to 1.8.0 () Update mkdocs-material to 6.2.3 () deps: add dependabot support () bump go to 1.15 () implement scan and skip rules () scan command refactor () Fixes dead link to old getting started page () Add support to extract rules to skip from terraform comments () bash output improvements () APE-1319: Revamped Getting Started Section () Add policy AC-K8-NS-SE-M-0188 for CVE-2020-8554 () set console mode on windows so colors render () Update mkdocs-material to 6.1.7 () Update policy example in the documentation () Fix link to rego playground in policies documentation () hopefully remove test failures due to non-deterministic comparisons () IMDSv1 policy: update category, description () IMDSv1 check policy () Add Docker image release tagging on release () Fix typo in architecture documentation () accurics.gcp.IAM.104 Fire rule when client certificate is enabled () Update mkdocs-material to 6.1.6 () Added Unit test coverage for Kustomize V3 Iac-provider () Fixes GCP cos node image policy () \#394: recognize that empty values for username and password in master () Fix infinite loop on variable resolution () Remove demo badge () Update mkdocs-material to 6.1.5 () Implemented enhancements: Add support for Helm Add 'git' to container image, or run container as 'root' user by default Add policy for checking insecure\ssl configuration for github\organization\_webhook in GitHub provider Rule for github\_repository seems to be wrongly placed under gcp Fixed bugs: Fail to validate when there are multiple properties with the same name in a resource Closed issues: Deep modules location mis-processed. 20MB binary file included in repo now Private GitHub repositories are not recognized with version 3.0.0+ of GitHub provider Terrascan -var-file=../another dir Error in test\aws\security\group\inline\rule\open and test\aws\security\group\rule\_open Initial setup after installation Add support for data sources Support from modules Merged pull requests: Bring Go to 1.15 in GitHub Actions () Bring Go to 1.15 in GitHub Actions () fix a bug when rendering subcharts () Added kustomize support () Adds support for Helm v3 () Update mkdocs-material to 6.1.4 () properly handle nested submodules \(\#365\) () Address \#365 by properly handling submodule path () Update mkdocs-material to 6.1.3 () Update mkdocs-material to

() Allow use of multiple policy types \(scan -t x,y or scan -t x -t y\) () Remove large binary that was included in the repo () fix send request method, previously hardcoded () Add git binary to terrascan docker image, required by downloader () Adds new policies/regos for AWS serverless services () Update mkdocs-material to 6.1.0 () Allow configuration of global policy config, fix some typos () Feature/support resolve variable references () Add new policy for checking insecure\ssl on github\organization\_webhook () Update mkdocs-material to 6.0.2 () Add support for colorized output () Update mkdocs-material to 6.0.1 () Adds support for remote Terraform modules and scanning remotely for other IaC tools () fix supported providers unit test, sort the wanted result () Fix typo on AWS IAM account password policy rego name () Update mkdocs-material to 5.5.14 () Adds docs section for GitHub policies () Automatically populate usage with supported IaC providers, versions, and policies () Add line about kubernetes YAML/JSON support () Add policy set for GitHub provider () Add check for visibility for github\_repository () Add instructions for booting terrascan demo () Implemented enhancements: Initial kubernetes support () Adds different exit code when issues are found () Adding terrascan to Homebrew Fixed bugs: Outdated Docker image Error with XML output Fixed checkIpForward rule \(gcp\) () Closed issues: Terrascan wrongly reports a accurics.gcp.NS.130 \(checkIpForward\) violation Allow structure output \(Json\) Throwing Errors when parsing nested brackets in HCL Be able to generate xml/html reports Merged pull requests: Revert "fixed a bug in checkIpForward" () Fixed a bug in checkIpForward () Move server command out of ENTRYPOINT and into CMD () Send logs to stderr instead of stdout () Fix template rendering bug () chore\(docs\): add homebrew installation () Update badges in readme () Update mkdocs-diagrams to 1.0.0 () Add support to print resource config as an output () Manage relative module path () Update mkdocs-material to 5.5.12 () chore\(docs\): fix indent of tar extraction () Fixes issue template and rego capitalization () Update mkdocs-material to 5.5.8 () Update about.md () Updated policies to the latest set () Fixes docker latest tag () Typo fixes () Update mkdocs-material to 5.5.7 () Fix xml output () Major updates to Terrascan and the underlying architecture including: Pluggable architecture written in Golang. We updated the architecture to be easier to extend Terrascan with additional IaC languages and support policies for different cloud providers and cloud native tooling. Server mode. This allows Terrascan to be executed as a server and use it's API to perform static code analysis Notifications hooks. Will be able to integrate for notifications to external systems (e.g. email, slack, etc.) Uses OPA policy engine and policies written in Rego. Introduces the '-f' flag for passing a list of ".tf" files for linting and the '--version' flag. Adds Docker image and pipeline to push to DockerHub Bugfix: The pyhcl hard dependency in the requirements.txt file caused issues if a higher version was installed. This was fixed by using the ">=" operator. Adds support for terraform 0.12+ Adds ability to setup terrascan as a pre-commit hook Updates dependent packages to latest versions Migrates CI to GitHub Actions from travis First release on PyPI. \ This Changelog was automatically generated by * \ This Changelog was automatically generated by * \ This Changelog was automatically generated by * \ This Changelog was automatically generated by * \ This Changelog was automatically generated by * \ This Changelog was automatically generated by *