Feat/resolve single depth references

[p0tr3c]

What

Introduce single depth of reference resolution in plan parsing.

Terraform plan cannot resolve all dependencies before apply stage. The unresolved items can still be useful however. We are currently using these references to link resources together in Rego.

Why

Mainly to solve the problem of terraform AWS provider v4.0.0 which introduced breaking changes to s3 bucket.

The reference structure in terraform is actually quite complex. This PR only does basic dereferencing for purposes of allowing us to link resources on first depth attributes. This is good enough to link related S3 resources together.

Review

Given TF plan included in the PR, the parser would produce following output

{
        "data": {},
        "resource": {
                "aws_s3_bucket": {
                        "denied": {
                                "bucket": "denied",
                                "bucket_prefix": null,
                                "force_destroy": false,
                                "tags": null
                        },
                        "duh": {
                                "bucket": "duh",
                                "bucket_prefix": null,
                                "force_destroy": false,
                                "tags": null
                        },
                        "logging2": {
                                "bucket": "logging2",
                                "bucket_prefix": null,
                                "force_destroy": false,
                                "tags": null
                        }
                },
                "aws_s3_bucket_logging": {
                        "example": {
                                "expected_bucket_owner": null,
                                "target_grant": [],
                                "target_prefix": "log/"
                        },
                        "example2": {
                                "expected_bucket_owner": null,
                                "target_grant": [],
                                "target_prefix": "log/"
                        }
                }
        }
}

The produced output does not have any information which allows us to link aws_s3_bucket_logging.example to aws_s3_bucket.logging2.

After the change the output looks like this file

You can see that now the aws_s3_bucket_logging.example contains bucket attribute which points to aws_s3_bucket.logging2

Testing

You can build the snyk-iac-rules with this branch. Run following to use this branch in your local build

go get github.com/snyk/snyk-iac-parsers@9fa1b8244d81efcbd135e7109be59bb6f8ffeec6

[CLAassistant]

All committers have signed the CLA.

[p15r]

🔥

[teodora-sandu]

@p0tr3c Are you waiting on something to merge this PR? The CLI PR is ready to merge too so let me know whenever you're happy with me merging it

[p0tr3c]

Lets merge it!