KyMidd

ebs_block_device = {
    "/dev/sdl" = {
      volume_type = "standard"
      volume_size = 50
      encrypted   = true
      kms_key_id  = var.kms_key_arn
    },
    "xvdf" = {
      volume_type = "gp2"
      volume_size = 200

KyMidd

# If all lines evaluated, and we still haven't decided to require approval, then all
#  resources have been checked and none triggered approval flow
if [[ $approvalRequired == "no" ]]; then
    echo "****************************************"
    echo "##[section]Approval will not be required"
    echo "****************************************"
    echo "##vso[task.setvariable variable=approvalRequired;isOutput=true]false"
    echo ""
    echo ""
fi

KyMidd

# If approval required, exit immediately and export values
if [[ $approvalRequired == "yes" ]]; then
    echo "****************************************"
    echo "##[section]Approval will be required"
    echo "****************************************"
    echo ""
    echo "##vso[task.setvariable variable=approvalRequired;isOutput=true]true"
    echo ""
    echo ""
    break

KyMidd

if [[ $line == *"will be created"* ]]; then
    echo "##[section]Approval not required for" $resource_path
    approvalRequired="no"
fi

KyMidd

if [[ $line == *"will be destroyed"* ]]; then

    # If destroyed resource is always unsafe, trigger approval
    if [[ ${ResourceTypesAlwaysUnsafe[@]} =~ ${resource_type} ]]; then
        # Mark this path unsafe, require approval
        echo "This resource is planned to be deleted, and is always unsafe to destroy without approval:" $resource_path
        approvalRequired="yes"

    # If destroyed resource is always safe, then don't trigger approval
    elif [[ ${ResourceTypesAlwaysSafe[@]} =~ ${resource_type} ]]; then

KyMidd

while IFS= read -r line; do

    # Set approvalRequired
    approvalRequired="notSure"

    # Prepare resource path, e.g.: module.networking.aws_security_group_rule.Inbound_192Slash16_PermitAll
    resource_path=$(echo $line | cut -d " " -f 2)
    # Prepare resource type, e.g.: aws_security_group_rule
    resource_type=$(echo $resource_path | rev | cut -d "." -f 2 | rev)

KyMidd

if terraform show plan.out | grep -q " 0 to add, 0 to change, 0 to destroy"; then 
    echo "##[section]No changes detected, terraform apply will not run";
    # There are no changes
    exit 0
fi

KyMidd

declare -a ResourceTypesAlwaysUnsafe=(
    "aws_instance"
    "foobar"
)
declare -a ResourceTypesAlwaysSafe=(
    "aws_security_group_rule"
    "foobar"
)

KyMidd

#!/bin/bash

# Plan.out is binary file populated with "terraform plan -out plan.out"
# Use terraform show to read plan.out as text, and filter for resource change lines, output to file
terraform show -no-color plan.out | grep "will be" > plan_decoded.out
terraform show -no-color plan.out | grep "must be" >> plan_decoded.out
input="plan_decoded.out"

KyMidd

- task: Bash@3
  name: AutoApprovalTest
  displayName: Auto-Approval Test
  inputs:
    filePath: '$(System.DefaultWorkingDirectory)/pipelines/auto_approval_testing/tf_safe_test.sh'
    arguments: ''
    workingDirectory: '$(System.DefaultWorkingDirectory)/$(tf_directory)'
    failOnStderr: false