HCL Bulk Edit

bulk_update.sh

#!/bin/bash

if [[ ! $(which hcledit) ]]; then
  echo "'hcledit' is not installed. Install via '$ brew install minamijoyo/hcledit/hcledit'"
  echo "  See https://github.com/minamijoyo/hcledit"
  exit 1
fi

POSITIONAL_ARGS=()
HCLEDIT_ACTIONS_TO_TAKE=()

while [[ $# -gt 0 ]]; do
  case $1 in
    --dir)
      TF_DIR="$2"
      shift
      shift
      ;;
    --tag-attribute)
      TAG_ATTRIBUTE="$2"
      shift
      shift
      ;;
    --disable)
      DISABLE="true"
      HCLEDIT_ACTIONS_TO_TAKE+="disable "
      shift
      ;;
    --enable)
      ENABLE="true"
      HCLEDIT_ACTIONS_TO_TAKE+="enable "
      shift
      ;;
    --find-by-tag)
      FIND_BY_TAG="$2"
      shift
      shift
      ;;
    --delete-tag)
      DELETE_TAG="$2"
      HCLEDIT_ACTIONS_TO_TAKE+="delete "
      shift
      shift
      ;;
    --add-tag)
      ADD_TAG="$2"
      HCLEDIT_ACTIONS_TO_TAKE+="add "
      shift
      shift
      ;;
    --update-tag)
      UPDATE_TAG="$2"
      HCLEDIT_ACTIONS_TO_TAKE+="set "
      shift
      shift
      ;;
    --update-tag-value)
      UPDATE_TAG_VALUE="$2"
      shift
      shift
      ;;
    *)
      POSITIONAL_ARGS+=("$1")
      shift
      ;;
  esac
done

set -- "${POSITIONAL_ARGS[@]}" # restore positional parameters

echo "dir             = ${TF_DIR}"
echo "tag attribute   = ${TAG_ATTRIBUTE}"
echo "find            = ${FIND_BY_TAG}"
echo "delete          = ${DELETE_TAG}"
echo "add             = ${ADD_TAG}"
echo "update          = ${UPDATE_TAG} -> ${UPDATE_TAG_VALUE}"
[[ -n ${ENABLE} ]] && echo "enable          = ${ENABLE}"
[[ -n ${DISABLE} ]] && echo "disable         = ${DISABLE}"

if [[ -z ${FIND_BY_TAG} ]]; then
  echo "--find-by-tag is required"
  exit 1
fi

if [[ -z ${TF_DIR} ]]; then
  echo "--dir is required"
  exit 1
fi

if [[ -z ${TAG_ATTRIBUTE} ]]; then
  echo "--tag-attribute is required (Hint: use --tag-attribute event_tags or --tag-attribute alert_tags)"
  exit 1
fi

if [[ -z ${DELETE_TAG} ]] && [[ -z ${ADD_TAG} ]] && [[ -z ${UPDATE_TAG} ]]; then
  echo "at least one of --delete-tag --add-tag or --update-tag is required"
  exit 1
fi

if [[ -n ${UPDATE_TAG} ]] && [[ -z ${UPDATE_TAG_VALUE} ]]; then
  echo "--update-tag given but not --update-tag-value"
  exit 1
fi

if [[ -n ${ENABLE} ]] && [[ -n ${DISABLE} ]]; then
  echo "Cannot provide both --disable and --enable"
  exit 1
fi

for FILE in $(find ${TF_DIR} -type f -name '*.tf'); do
  RESOURCE_NAME=$(hcledit -f ${FILE} block list)
  if [[ $(echo ${RESOURCE_NAME} | grep '^resource') ]]; then
    if [[ $(hcledit -f ${FILE} attribute get ${RESOURCE_NAME}.${TAG_ATTRIBUTE} | grep ${FIND_BY_TAG}) ]]; then
      for ACTION in $HCLEDIT_ACTIONS_TO_TAKE; do
        TAGS=""
        if [[ ${ACTION} == "enable" ]]; then
          hcledit -u -f ${FILE} attribute set ${RESOURCE_NAME}.enabled true >/dev/null 2>&1
        elif [[ ${ACTION} == "disable" ]]; then
          hcledit -u -f ${FILE} attribute set ${RESOURCE_NAME}.enabled false >/dev/null 2>&1
        elif [[ ${ACTION} == "set" ]]; then
          TAGS=$(hcledit -f ${FILE} attribute get ${RESOURCE_NAME}.${TAG_ATTRIBUTE} | sed "s/${UPDATE_TAG}/${UPDATE_TAG_VALUE}/g")
        elif [[ ${ACTION} == "add" ]]; then
          TAGS=$(hcledit -f ${FILE} attribute get ${RESOURCE_NAME}.${TAG_ATTRIBUTE} | sed "s/]$/  \"${ADD_TAG}\",\\n]/g")
        elif [[ ${ACTION} == "delete" ]]; then
          TAGS=$(hcledit -f ${FILE} attribute get ${RESOURCE_NAME}.${TAG_ATTRIBUTE} | awk "!/\"${DELETE_TAG}\",/")
        fi
        [[ -n ${TAGS} ]] && hcledit -u -f ${FILE} attribute set ${RESOURCE_NAME}.${TAG_ATTRIBUTE} "${TAGS}" >/dev/null 2>&1
        terraform fmt ${FILE}
      done
    fi
  fi
done

✗ # For all event rules that have a tag 'macOS':
✗ # Enable rule
✗ # Also update the tag T1547 to T1548
✗ # Also delete the tag 'Plist Modification'
✗ # Also add the tag 'MARCUS_TEST'
✗ bash bulk_update.sh \
  --dir eventrules \
  --tag-attribute event_tags \
  --find-by-tag macOS \
  --update-tag T1547 \
  --update-tag-value T1548 \
  --delete-tag "Plist Modification" \
  --add-tag MARCUS_TEST \
  --enable

✗ # For all alert rules that have a tag 'T1547':
✗ # Add the tag 'RSIC_DISABLED'
✗ # Also disable rule
✗ bash bulk_update.sh \
  --dir alertrules \
  --tag-attribute alert_tags \
  --find-by-tag T1547 \
  --add-tag RSIC_DISABLED \
  --disable