Extending TFDrift-Falco¶

package notifier

import (
    "context"
    "fmt"
    "time"

    log "github.com/sirupsen/logrus"
)

// CustomNotifier は独自の通知チャネル実装
type CustomNotifier struct {
    apiEndpoint string
    apiKey      string
    timeout     time.Duration
}

// NewCustomNotifier creates a new custom notifier
func NewCustomNotifier(endpoint, apiKey string, timeout time.Duration) *CustomNotifier {
    return &CustomNotifier{
        apiEndpoint: endpoint,
        apiKey:      apiKey,
        timeout:     timeout,
    }
}

// Notify sends a drift event notification to the custom channel
func (n *CustomNotifier) Notify(ctx context.Context, event *DriftEvent) error {
    log.Infof("Sending notification to custom channel: %s", event.ResourceType)

    // 通知ペイロード作成
    payload := n.buildPayload(event)

    // HTTPリクエスト送信
    client := &http.Client{Timeout: n.timeout}
    req, err := http.NewRequestWithContext(ctx, "POST", n.apiEndpoint, bytes.NewBuffer(payload))
    if err != nil {
        return fmt.Errorf("failed to create request: %w", err)
    }

    // 認証ヘッダー追加
    req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", n.apiKey))
    req.Header.Set("Content-Type", "application/json")

    // リクエスト送信
    resp, err := client.Do(req)
    if err != nil {
        return fmt.Errorf("failed to send notification: %w", err)
    }
    defer resp.Body.Close()

    // レスポンス確認
    if resp.StatusCode >= 400 {
        body, _ := io.ReadAll(resp.Body)
        return fmt.Errorf("notification failed with status %d: %s", resp.StatusCode, string(body))
    }

    log.Infof("Notification sent successfully to custom channel")
    return nil
}

// buildPayload creates the notification payload
func (n *CustomNotifier) buildPayload(event *DriftEvent) []byte {
    payload := map[string]interface{}{
        "event_type":    "terraform_drift",
        "resource_type": event.ResourceType,
        "resource_id":   event.ResourceID,
        "change_type":   event.ChangeType,
        "severity":      event.Severity,
        "user":          event.User,
        "region":        event.Region,
        "timestamp":     event.DetectedAt.Format(time.RFC3339),
        "details":       event.Details,
    }

    data, err := json.Marshal(payload)
    if err != nil {
        log.Errorf("Failed to marshal payload: %v", err)
        return []byte("{}")
    }

    return data
}

// Name returns the notifier name
func (n *CustomNotifier) Name() string {
    return "custom"
}

// NotificationConfig contains notification settings
type NotificationConfig struct {
    Slack   *SlackConfig   `yaml:"slack"`
    Discord *DiscordConfig `yaml:"discord"`
    Webhook *WebhookConfig `yaml:"webhook"`
    Custom  *CustomConfig  `yaml:"custom"`  // 追加
}

// CustomConfig contains custom notifier settings
type CustomConfig struct {
    Enabled     bool   `yaml:"enabled"`
    APIEndpoint string `yaml:"api_endpoint"`
    APIKey      string `yaml:"api_key"`
    Timeout     string `yaml:"timeout"`  // "10s", "30s" など
}

// NewNotificationManager creates a new notification manager
func NewNotificationManager(cfg *config.Config) *NotificationManager {
    notifiers := []Notifier{}

    // Slack
    if cfg.Notifications.Slack != nil && cfg.Notifications.Slack.Enabled {
        notifiers = append(notifiers, NewSlackNotifier(cfg.Notifications.Slack))
    }

    // Discord
    if cfg.Notifications.Discord != nil && cfg.Notifications.Discord.Enabled {
        notifiers = append(notifiers, NewDiscordNotifier(cfg.Notifications.Discord))
    }

    // Webhook
    if cfg.Notifications.Webhook != nil && cfg.Notifications.Webhook.Enabled {
        notifiers = append(notifiers, NewWebhookNotifier(cfg.Notifications.Webhook))
    }

    // Custom (追加)
    if cfg.Notifications.Custom != nil && cfg.Notifications.Custom.Enabled {
        timeout, _ := time.ParseDuration(cfg.Notifications.Custom.Timeout)
        if timeout == 0 {
            timeout = 10 * time.Second
        }
        notifiers = append(notifiers, NewCustomNotifier(
            cfg.Notifications.Custom.APIEndpoint,
            cfg.Notifications.Custom.APIKey,
            timeout,
        ))
    }

    return &NotificationManager{
        notifiers: notifiers,
    }
}

// pkg/notifier/pagerduty_notifier.go
package notifier

import (
    "bytes"
    "context"
    "encoding/json"
    "fmt"
    "net/http"
    "time"

    log "github.com/sirupsen/logrus"
)

type PagerDutyNotifier struct {
    integrationKey string
    timeout        time.Duration
}

func NewPagerDutyNotifier(integrationKey string) *PagerDutyNotifier {
    return &PagerDutyNotifier{
        integrationKey: integrationKey,
        timeout:        10 * time.Second,
    }
}

func (n *PagerDutyNotifier) Notify(ctx context.Context, event *DriftEvent) error {
    // PagerDuty Events API v2 ペイロード
    payload := map[string]interface{}{
        "routing_key":  n.integrationKey,
        "event_action": "trigger",
        "payload": map[string]interface{}{
            "summary":  fmt.Sprintf("Drift Detected: %s", event.ResourceType),
            "severity": n.mapSeverity(event.Severity),
            "source":   "tfdrift-falco",
            "custom_details": map[string]interface{}{
                "resource_type": event.ResourceType,
                "resource_id":   event.ResourceID,
                "user":          event.User,
                "region":        event.Region,
                "change_type":   event.ChangeType,
            },
        },
    }

    data, _ := json.Marshal(payload)

    client := &http.Client{Timeout: n.timeout}
    req, err := http.NewRequestWithContext(ctx, "POST",
        "https://events.pagerduty.com/v2/enqueue", bytes.NewBuffer(data))
    if err != nil {
        return fmt.Errorf("failed to create PagerDuty request: %w", err)
    }

    req.Header.Set("Content-Type", "application/json")

    resp, err := client.Do(req)
    if err != nil {
        return fmt.Errorf("failed to send PagerDuty notification: %w", err)
    }
    defer resp.Body.Close()

    if resp.StatusCode >= 400 {
        return fmt.Errorf("PagerDuty API returned status %d", resp.StatusCode)
    }

    log.Info("PagerDuty incident created successfully")
    return nil
}

func (n *PagerDutyNotifier) mapSeverity(severity string) string {
    switch severity {
    case "critical":
        return "critical"
    case "high":
        return "error"
    case "medium":
        return "warning"
    default:
        return "info"
    }
}

func (n *PagerDutyNotifier) Name() string {
    return "pagerduty"
}

func (s *Subscriber) mapEventToResourceType(eventName string, eventSource string) string {
    // イベント名の衝突解決（eventSource使用）
    switch eventName {
    case "CreateAlias", "DeleteAlias", "UpdateAlias":
        if eventSource == "lambda.amazonaws.com" {
            return "aws_lambda_alias"
        }
        if eventSource == "kms.amazonaws.com" || eventSource == "" {
            return "aws_kms_alias"
        }
    }

    // 標準マッピング
    mapping := map[string]string{
        // EC2
        "RunInstances":       "aws_instance",
        "TerminateInstances": "aws_instance",

        // 新しいサービスを追加
        "CreateCluster":      "aws_ecs_cluster",
        "DeleteCluster":      "aws_ecs_cluster",
    }

    if resourceType, ok := mapping[eventName]; ok {
        return resourceType
    }

    return "unknown"
}

// pkg/falco/resource_mapper.go

mapping := map[string]string{
    // ... existing mappings ...

    // AWS App Runner (新規追加)
    "CreateService":        "aws_apprunner_service",
    "DeleteService":        "aws_apprunner_service",
    "UpdateService":        "aws_apprunner_service",
    "CreateAutoScalingConfiguration": "aws_apprunner_auto_scaling_configuration_version",
    "DeleteAutoScalingConfiguration": "aws_apprunner_auto_scaling_configuration_version",
    "CreateConnection":     "aws_apprunner_connection",
    "DeleteConnection":     "aws_apprunner_connection",
    "CreateVpcConnector":   "aws_apprunner_vpc_connector",
    "DeleteVpcConnector":   "aws_apprunner_vpc_connector",
}

// pkg/gcp/resource_mapper.go

func mapGCPEventToResourceType(methodName string, resourceType string) string {
    mapping := map[string]string{
        // ... existing mappings ...

        // Cloud Spanner (新規追加)
        "google.spanner.admin.instance.v1.InstanceAdmin.CreateInstance": "google_spanner_instance",
        "google.spanner.admin.instance.v1.InstanceAdmin.DeleteInstance": "google_spanner_instance",
        "google.spanner.admin.instance.v1.InstanceAdmin.UpdateInstance": "google_spanner_instance",
        "google.spanner.admin.database.v1.DatabaseAdmin.CreateDatabase": "google_spanner_database",
        "google.spanner.admin.database.v1.DatabaseAdmin.DropDatabase":   "google_spanner_database",
    }

    if rt, ok := mapping[methodName]; ok {
        return rt
    }

    return "unknown"
}

func TestMapEventToResourceType_AppRunner(t *testing.T) {
    sub := &Subscriber{}

    tests := []struct {
        name        string
        eventName   string
        eventSource string
        want        string
    }{
        {"App Runner Service Create", "CreateService", "apprunner.amazonaws.com", "aws_apprunner_service"},
        {"App Runner Service Delete", "DeleteService", "apprunner.amazonaws.com", "aws_apprunner_service"},
        {"App Runner AutoScaling", "CreateAutoScalingConfiguration", "apprunner.amazonaws.com", "aws_apprunner_auto_scaling_configuration_version"},
    }

    for _, tt := range tests {
        t.Run(tt.name, func(t *testing.T) {
            got := sub.mapEventToResourceType(tt.eventName, tt.eventSource)
            assert.Equal(t, tt.want, got)
        })
    }
}

// pkg/plugin/plugin.go
package plugin

import (
    "context"
)

// Plugin is the interface that all plugins must implement
type Plugin interface {
    // Name returns the plugin name
    Name() string

    // Version returns the plugin version
    Version() string

    // Initialize initializes the plugin with configuration
    Initialize(config map[string]interface{}) error

    // OnDriftDetected is called when a drift is detected
    OnDriftDetected(ctx context.Context, event *DriftEvent) error

    // OnStateRefresh is called when Terraform state is refreshed
    OnStateRefresh(ctx context.Context, state *TerraformState) error

    // Cleanup cleans up plugin resources
    Cleanup() error
}

// DriftEvent represents a detected drift event
type DriftEvent struct {
    ResourceType string
    ResourceID   string
    ChangeType   string
    Severity     string
    User         string
    Region       string
    DetectedAt   time.Time
    Details      map[string]interface{}
}

// plugins/auto_remediation/plugin.go
package main

import (
    "context"
    "fmt"

    "github.com/aws/aws-sdk-go-v2/config"
    "github.com/aws/aws-sdk-go-v2/service/ec2"
    log "github.com/sirupsen/logrus"
)

type AutoRemediationPlugin struct {
    ec2Client *ec2.Client
    enabled   bool
}

func (p *AutoRemediationPlugin) Name() string {
    return "auto-remediation"
}

func (p *AutoRemediationPlugin) Version() string {
    return "0.1.0"
}

func (p *AutoRemediationPlugin) Initialize(cfg map[string]interface{}) error {
    p.enabled = cfg["enabled"].(bool)

    // AWS SDK初期化
    awsCfg, err := config.LoadDefaultConfig(context.TODO())
    if err != nil {
        return fmt.Errorf("failed to load AWS config: %w", err)
    }

    p.ec2Client = ec2.NewFromConfig(awsCfg)
    log.Info("Auto-remediation plugin initialized")
    return nil
}

func (p *AutoRemediationPlugin) OnDriftDetected(ctx context.Context, event *DriftEvent) error {
    if !p.enabled {
        return nil
    }

    log.Infof("Auto-remediation triggered for %s", event.ResourceType)

    // EC2インスタンスのTermination Protection無効化を自動修正
    if event.ResourceType == "aws_instance" && event.ChangeType == "disable_api_termination" {
        return p.reEnableTerminationProtection(ctx, event.ResourceID)
    }

    return nil
}

func (p *AutoRemediationPlugin) reEnableTerminationProtection(ctx context.Context, instanceID string) error {
    _, err := p.ec2Client.ModifyInstanceAttribute(ctx, &ec2.ModifyInstanceAttributeInput{
        InstanceId: &instanceID,
        DisableApiTermination: &types.AttributeBooleanValue{
            Value: aws.Bool(true),
        },
    })

    if err != nil {
        return fmt.Errorf("failed to re-enable termination protection: %w", err)
    }

    log.Infof("Termination protection re-enabled for instance %s", instanceID)
    return nil
}

func (p *AutoRemediationPlugin) OnStateRefresh(ctx context.Context, state *TerraformState) error {
    // State refresh時の処理（必要に応じて実装）
    return nil
}

func (p *AutoRemediationPlugin) Cleanup() error {
    log.Info("Auto-remediation plugin cleaned up")
    return nil
}

// プラグインのエクスポート（Go 1.8+ plugin system）
var Plugin AutoRemediationPlugin