Initial Release

.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# These owners will be the default owners for everything in the repo. Unless a later match takes precedence.
+
+* @jasonmacallister @mscribellito

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,27 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/enhancement-request.md

@@ -0,0 +1,20 @@
+---
+name: Enhancement request
+about: Suggest an idea for this project
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/workflows/org-checkov.yml

@@ -0,0 +1,96 @@
+name: Checkov PR Scan
+
+on:
+  pull_request:
+    paths:
+      - '**.tf'
+  workflow_call:
+
+jobs:
+  checkov_scan:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v2
+      with:
+        fetch-depth: 0
+        ref: ${{ github.head_ref }}
+
+    - name: Set up Python
+      uses: actions/setup-python@v2
+      with:
+        python-version: 3.x
+
+    - name: Install Checkov
+      run: |
+        pip install checkov
+
+    - name: Get changed Terraform files
+      id: get_changed_files
+      run: |
+        echo "::set-output name=files::$(git diff --name-only --diff-filter=d origin/${{ github.base_ref }}..${{ github.head_ref }} -- '*.tf' | tr '\n' ' ')"
+
+    - name: Run Checkov
+      id: checkov
+      run: |
+          IFS=$'\n' read -ra FILES <<< "$(echo ${{ steps.get_changed_files.outputs.files }} | tr ' ' '\n')"
+          PASSED=true
+          RESULTS=()
+          for file in "${FILES[@]}"; do
+            if [ -n "$file" ]; then
+              OUTPUT=$(checkov -f "$file" --output json || true)
+              RESULTS+=("$OUTPUT")
+              if [[ "$(echo "$OUTPUT" | jq '.results.failed_checks | length')" -gt 0 ]]; then
+                PASSED=false
+              fi
+            fi
+          done
+          echo "["$(IFS=,; echo "${RESULTS[*]}")"]" > $GITHUB_WORKSPACE/checkov_results.json
+          echo "CHECKOV_PASSED=$PASSED" | tee -a $GITHUB_ENV
+     
+
+    - name: Create comments with Checkov results
+      uses: actions/github-script@v5
+      with:
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+        script: |
+          const fs = require('fs');
+          const rawChecks = JSON.parse(fs.readFileSync(`${process.env.GITHUB_WORKSPACE}/checkov_results.json`, 'utf8'));
+          const checks = rawChecks.reduce((acc, check) => {
+             if ('results' in check && 'failed_checks' in check.results) {
+               return acc.concat(check.results.failed_checks);
+             }
+             return acc;
+           }, []);
+           const files = [...new Set(checks.map((check) => check.file_path))];
+        
+           if (files.length == 0) {
+             const output = `🌟 No Terraform files were modified in this PR or all modified Terraform files passed the Checkov checks. Good job! 🌟`;
+             await github.rest.issues.createComment({
+               owner: context.repo.owner,
+               repo: context.repo.repo,
+               issue_number: context.issue.number,
+               body: output
+             });
+           } else {
+             let output = `#### Checkov Scan Results 📖:\n\n` +
+               `| File | Check ID | Description | Resource | Checkov Result |\n` +
+               `| ---- | -------- | ----------- | -------- | -------------- |\n`;
+             for (const file of files) {
+               const fileChecks = checks.filter((check) => check.file_path === file);
+               output += fileChecks
+                   .map((check) => {
+                       return `| ${file} | ${check.check_id} | ${check.check_name} | ${check.resource} | ${check.check_result.result} |\n`;
+                   })
+                   .join("");
+             }
+             output += `\n\nPlease review the above report. ⚠️`;
+             await github.rest.issues.createComment({
+               owner: context.repo.owner,
+               repo: context.repo.repo,
+               issue_number: context.issue.number,
+               body: output
+             });
+          }
+        

.github/workflows/org-markdown-lint.yml

@@ -0,0 +1,65 @@
+name: README-Lint
+on:
+  pull_request:
+    paths:
+      - '**.md'
+    branches:
+      - main
+  workflow_call:
+
+jobs:
+  lint-README:
+    name: Lint README file
+    runs-on: ubuntu-latest
+    steps:
+    - name: Check out code
+      uses: actions/checkout@v2
+
+    - name: Get list of changed Markdown files
+      id: get-md-files
+      run: |
+        echo "::set-output name=files::$(git diff --name-only --diff-filter=d origin/main... | grep .md)"
+        
+    - name: Lint Markdown files
+      uses: docker://avtodev/markdown-lint:v1 # fastest way
+      id: lintFile
+      with:
+        config: '/lint/config/changelog.yml'
+        output: './.github/md_lint_output.txt'
+        args: ${{ steps.get-md-files.outputs.files }}
+
+    - name: Output file contents
+      id: outputCont
+      if: ${{ failure() }}
+      run: |
+        OUTPUT_STRING=$(cat $(pwd)/.github/md_lint_output.txt)
+        OUTPUT_STRING="${OUTPUT_STRING//'%'/'%25'}"
+        OUTPUT_STRING="${OUTPUT_STRING//$'\n'/'%0A'}"
+        OUTPUT_STRING="${OUTPUT_STRING//$'\r'/'%0D'}"
+        echo "::set-output name=outFile::$OUTPUT_STRING"
+
+    - name: Create Fail Comment
+      uses: actions/github-script@v5
+      if: ${{ failure() }}
+      with:
+        github-token: ${{secrets.GITHUB_TOKEN}}
+        script: |
+          github.rest.issues.createComment({
+            issue_number: context.issue.number,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            body: `${{steps.outputCont.outputs.outFile}}`
+          })
+
+    - name: Create Success Comment
+      uses: actions/github-script@v5
+      if: ${{ success() }}
+      with:
+        github-token: ${{secrets.GITHUB_TOKEN}}
+        script: |
+          github.rest.issues.createComment({
+            issue_number: context.issue.number,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            body: 'Markdown Valid'
+          })

.github/workflows/org-release.yml

@@ -0,0 +1,36 @@
+name: Tag and Release
+on:
+  pull_request:
+    types:
+    - closed
+    branches:
+    - main
+  workflow_call:
+
+jobs:
+  release:
+    if: github.event.pull_request.merged == true
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v3
+      with:
+        ref: ${{ github.sha }}
+        fetch-depth: '0'
+
+    - name: Bump version and push tag
+      id: create_tag
+      uses: anothrNick/[email protected] 
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        WITH_V: true
+        DEFAULT_BUMP: patch
+
+    - name: Create release
+      uses: "marvinpinto/action-automatic-releases@latest"
+      with:
+        repo_token: "${{ secrets.GITHUB_TOKEN }}"
+        automatic_release_tag: "${{ steps.create_tag.outputs.tag }}"
+        title: "Release ${{ steps.create_tag.outputs.tag }}"
+        draft: false
+        prerelease: false

.github/workflows/org-terraform-docs.yml

@@ -0,0 +1,8 @@
+name: Org Terraform Docs
+on:
+    pull_request:
+    workflow_call:
+
+jobs:
+  terraform-docs:
+    uses: Coalfire-CF/Actions/.github/workflows/org-terraform-docs.yml@main

.gitignore

@@ -0,0 +1,36 @@
+# Local .terraform directories
+**/.terraform/*
+
+# .tfstate files
+*.tfstate
+*.tfstate.*
+
+# Crash log files
+crash.log
+
+# Ignore override files as they are usually used to override resources locally and so
+# are not checked in
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
+# example: *tfplan*
+
+.idea
+.idea/*
+.vscode
+.vscode/
+*.iml
+*.zip
+.DS_Store
+
+# NessusBurp Install files are too large to commit
+**/nessusburp/*.exe
+**/nessusburp/*.msi
+**/nessusburp/*.txt
+
+# Ansible
+*.pub
+*.ppk

CONTRIBUTING.md

@@ -0,0 +1,72 @@
+# Contributing
+
+When contributing to this repository, please first discuss the change you wish to make via issue,
+email, or any other method with the owners of this repository before making a change.
+
+Please note we have a code of conduct, please follow it in all your interactions with the project.
+
+## Pull Request Process
+
+1. Ensure any install or build dependencies are removed before the end of the layer when doing a
+   build.
+2. Update the README.md with details of changes to the interface, this includes new environment
+   variables, exposed ports, useful file locations and container parameters.
+3. Increase the version numbers in any examples files and the README.md to the new version that this
+   Pull Request would represent. The versioning scheme we use is [SemVer](http://semver.org/).
+4. You may merge the Pull Request in once you have the sign-off of two other developers, or if you
+   do not have permission to do that, you may request the second reviewer to merge it for you.
+
+## Coalfire Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we, as contributors and project maintainers, pledge to make participation in our project and our community a harassment-free experience for everyone.
+
+## Our Values
+
+We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community. Our community reflects our company values:
+
+Respect: We believe in acknowledging the rights, beliefs, and perspectives of others.
+
+Excellence: We endeavor to adopt best practices in everything we do.
+
+Leadership: We encourage thought leadership and innovation.
+
+Integrity: We uphold the highest ethical standards in all our interactions.
+
+Teamwork: We believe in the power of working together to achieve our common goals.
+
+Enthusiasm: We approach every task with energy and eagerness.
+
+## Expected Behavior
+
+Demonstrate empathy and kindness toward other people.
+
+Be respectful of differing opinions, viewpoints, and experiences.
+
+Offer and gracefully accept constructive feedback.
+
+Show courtesy and respect in public and private communications.
+
+Avoid personal attacks directed toward other contributors.
+
+## Unacceptable Behavior
+
+Any form of discrimination and harassment is unacceptable. This includes but is not
+limited to; offensive comments related to gender, sexual orientation, race, religion, disability, physical appearance, or other protected categories.
+
+Public or private harassment, deliberate intimidation, violence, or threats of.
+
+Publishing others’ private information, such as a physical or email address, without their explicit permission.
+
+• The use of sexualized language or imagery and unwelcome sexual attention or advances.
+
+• Trolling, insulting/derogatory comments, and personal or political attacks.
+
+## Reporting & Enforcement
+
+We encourage all communities to resolve issues on their own whenever possible. If you are unable to resolve the matter for any reason, or if the behavior is threatening or harassing, report it. We are dedicated to providing an environment where participants feel welcome and safe. Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at <[email protected]>. All complaints will be reviewed and investigated promptly and fairly. Confidentiality will be maintained for the reporter of an incident.
+
+We will use our discretion in determining when and how we follow up with reported incidents.  Consequences of violating this code may include, but are not limited to, a temporary or permanent ban from project participation, removal of contributions, and reporting the incident to employers or legal authorities as appropriate.  
+
+This Code of Conduct is a living document and will evolve with the community. The project maintainers reserve the right to update this code as necessary. Any changes will be communicated to community members.

LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright 2023 Coalfire
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.