Add support to extract rules to skip from terraform comments

[kanchwala-yusuf]

This PR adds support for extracting rule ids to skip policy evaluation. These rules can be set as a comma separated list of rule ids in the comments of terraform resource config in the following pattern:

#ts:skip=AWS.S3Bucket.DS.High.1041, AWS.S3Bucket.DS.High.1042

Example of a terraform resource config with rules to skip policy evaluation:

resource "aws_s3_bucket" "bucket2" {
   #ts:skip=AWS.S3Bucket.DS.High.1041
   region        = var.region
   bucket        = local.bucket_name
   #ts:skip=AWS.S3Bucket.DS.High.1044,AWS.S3Bucket.DS.High.1045
   force_destroy = true
   #ts:skip= AWS.S3Bucket.DS.High.1046   ,   AWS.S3Bucket.DS.High.1047
   acl           = "public-read"
 }

[codecov]

Codecov Report

Merging #434 (08f94ec) into master (c39a76d) will increase coverage by 0.11%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##           master     #434      +/-   ##
==========================================
+ Coverage   74.46%   74.57%   +0.11%     
==========================================
  Files          87       88       +1     
  Lines        2005     2014       +9     
==========================================
+ Hits         1493     1502       +9     
  Misses        379      379              
  Partials      133      133              

Impacted Files	Coverage Δ
pkg/iac-providers/terraform/v12/resource.go	66.66% <100.00%> (+1.66%)	⬆️
pkg/utils/skip_rules.go	100.00% <100.00%> (ø)

[williepaul]

Just FYI, I think the rule ID format may go through some changes prior to the next release.

[kanchwala-yusuf]

Yes, kept that in mind!

[williepaul]

Changes look fine, my only thought is about the skip_rules param when it is null. Shall we mark this in the json as omitempty? It seems like that would simplify some of the test data by not having to include it when null. Also, it prevents an empty field from being printed out in the yaml/json/xml output.

[kanchwala-yusuf]

Changes look fine, my only thought is about the skip_rules param when it is null. Shall we mark this in the json as omitempty? It seems like that would simplify some of the test data by not having to include it when null. Also, it prevents an empty field from being printed out in the yaml/json/xml output.

@williepaul, I agree with you and I do not have a problem using omitempty flag as well. The reason it is kept as it because skip_rules would be in output of --config-only option which is primarily used for debugging. And the thought that keep the skip_rules field untouched would help in debugging.

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
2 Code Smells

No Coverage information
0.0% Duplication