Fixing a problem while reading the plan (#494) (#497)

* Fixing a problem while reading the plan (#494)

If a state file contains "child_modules", below error is thrown.
So this commit will handle the case of supporting child modules.

ERROR: state.out.json is not a valid terraform plan json output.

* Update terraform_compliance/common/readable_plan.py

Co-authored-by: Emre Erkunt <[email protected]>

* Update tests/functional/test_child_modules/main.tf

Co-authored-by: Emre Erkunt <[email protected]>

Co-authored-by: Praveen Shilavantar <[email protected]>
Co-authored-by: Emre Erkunt <[email protected]>

terraform_compliance/common/readable_plan.py

@@ -73,7 +73,7 @@ def __call__(self, parser, namespace, values, option_string=None):
 
             # Check if this is a state file
             if 'values' in data:
-                assert data['values']['root_module']['resources']
+                assert data['values']['root_module'].get('resources', data['values']['root_module'].get('child_modules'))
 
             # Then it must be a terraform plan file
             else:
@@ -85,4 +85,4 @@ def __call__(self, parser, namespace, values, option_string=None):
             sys.exit(1)
 
         setattr(namespace, self.dest, os.path.abspath(values))
-        return True
+        return True

tests/functional/test_child_modules/main.tf

@@ -0,0 +1,13 @@
+resource "aws_s3_bucket" "fail" {
+  bucket = "some_random_bucket_name-123808h0i1h3085018g531"
+  acl    = "private"
+
+  server_side_encryption_configuration {
+    rule {
+      apply_server_side_encryption_by_default {
+        kms_master_key_id = "123456"
+        sse_algorithm     = "aws:kms"
+      }
+    }
+  }
+}

tests/functional/test_child_modules/plan.out.json

@@ -0,0 +1 @@
+{"format_version":"0.1","terraform_version":"0.12.12","values":{"root_module":{"child_modules":[{"resources":[{"address":"aws_s3_bucket.fail","mode":"managed","type":"aws_s3_bucket","name":"fail","provider_name":"aws","schema_version":0,"values":{"acl":"private","bucket":"some_random_bucket_name-123808h0i1h3085018g531","bucket_prefix":null,"cors_rule":[],"force_destroy":false,"lifecycle_rule":[],"logging":[],"object_lock_configuration":[],"policy":null,"replication_configuration":[],"server_side_encryption_configuration":[{"rule":[{"apply_server_side_encryption_by_default":[{"kms_master_key_id":"123456","sse_algorithm":"aws:kms"}]}]}],"tags":null,"website":[]}}]}]}}}

tests/functional/test_child_modules/test.feature

@@ -0,0 +1,7 @@
+Feature: Feature for issue 494, adding support for Child Modules
+	This features confirms if child modules is supported
+
+	@noskip
+  	Scenario: Check if an S3 bucket is encrypted
+ 		Given I have aws_s3_bucket defined
+ 		Then it must contain server_side_encryption_configuration