Hello! 👋
I noticed in the README that the AWS backend is currently "under maintenance". I decided to run the existing Terraform code for the AWS backend (backend_modules/aws/) through a static analysis tool my team is developing (InfraScan) to see if there were any low-hanging fruits that might help with the restoration or future stability of that backend.
The AWS backend code scored a solid "B" (92.8%), which is great! However, there are a few practical tweaks that could make it more cost-effective and secure for users who decide to spin it up:
1. NAT Gateway Costs (Cost Optimization)
The aws_nat_gateway.nat resource is provisioned in backend_modules/aws/network/main.tf.
- Impact: For a test environment (which
sumaform primarily targets), a managed NAT Gateway is often an overkill expense.
- Suggestion: Since this is for testing, you might consider using a cheaper "NAT Instance" alternative or making the NAT Gateway optional via a variable, allowing users to spin up purely public subnets if their security model allows it for testing.
2. Missing AWS Budget (Cost Safety)
The AWS provider configuration does not include a budget.
- Impact: Users spinning up complex test labs with multiple VMs can easily forget to
tofu destroy. Adding an aws_budgets_budget would be a great safety net to alert them if their "temporary" test lab is racking up bills.
3. RDS Encryption & Deletion Protection (Security)
The RDS instance (backend_modules/aws/db_host/main.tf) flags for missing storage_encrypted and deletion_protection.
- Impact: Even for test data, encrypting at rest is a best practice that costs nothing. Enabling deletion protection helps prevent accidental data loss during
tofu operations if someone targets the wrong resource.
If you'd like to see the specific lines of code, the full interactive report is available here:
👉 View Full InfraScan Report for sumaform
(Full disclosure: the link above is generated by our tool, but I manually reviewed the findings to make sure they are relevant to a test-infrastructure tool like sumaform).
P.S. InfraScan is fully Open Source! We're building a community around better infrastructure defaults and we'd love to have your input given your experience with managing complex IaC backends.
If you are planning to revive the AWS backend soon, I'd be happy to submit a PR with these cost/security tweaks to help get it back in shape!
Hello! 👋
I noticed in the README that the AWS backend is currently "under maintenance". I decided to run the existing Terraform code for the AWS backend (
backend_modules/aws/) through a static analysis tool my team is developing (InfraScan) to see if there were any low-hanging fruits that might help with the restoration or future stability of that backend.The AWS backend code scored a solid "B" (92.8%), which is great! However, there are a few practical tweaks that could make it more cost-effective and secure for users who decide to spin it up:
1. NAT Gateway Costs (Cost Optimization)
The
aws_nat_gateway.natresource is provisioned inbackend_modules/aws/network/main.tf.sumaformprimarily targets), a managed NAT Gateway is often an overkill expense.2. Missing AWS Budget (Cost Safety)
The AWS provider configuration does not include a budget.
tofu destroy. Adding anaws_budgets_budgetwould be a great safety net to alert them if their "temporary" test lab is racking up bills.3. RDS Encryption & Deletion Protection (Security)
The RDS instance (
backend_modules/aws/db_host/main.tf) flags for missingstorage_encryptedanddeletion_protection.tofuoperations if someone targets the wrong resource.If you'd like to see the specific lines of code, the full interactive report is available here:
👉 View Full InfraScan Report for sumaform
(Full disclosure: the link above is generated by our tool, but I manually reviewed the findings to make sure they are relevant to a test-infrastructure tool like sumaform).
P.S. InfraScan is fully Open Source! We're building a community around better infrastructure defaults and we'd love to have your input given your experience with managing complex IaC backends.
If you are planning to revive the AWS backend soon, I'd be happy to submit a PR with these cost/security tweaks to help get it back in shape!