
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
@cdktf/hcl2cdk
Advanced tools
Uses @cdktf/hcl2cdk
to transform HCL configuration to CDK constructs.
yarn add @cdktf/hcl2cdk
import { convert } from "@cdktf/hcl2cdk";
const hcl = `
variable "name" {
description = "Name to be used on all the resources as identifier"
type = string
default = ""
}
`(async () => {
const ts = await convert(hcl, { language: "typescript" });
console.log(ts.imports); // just the necessary imports
console.log(ts.code); // just the constructs
console.log(ts.all); // code with imports
})();
// =>
import * as cdktf from "cdktf";
new cdktf.TerraformVariable(this, "imageId", {
type: "string",
default: "ami-abcde123",
description: "What AMI to use to create an instance",
});
import * as hcl2cdk from "@cdktf/hcl2cdk";
import {
readSchema,
ConstructsMakerProviderTarget,
LANGUAGES,
config,
} from "@cdktf/provider-generator";
(async () => {
const hcl = hcl2cdk.getTerraformConfigFromDir("/path/to/terraform/project");
const providerRequirements = await hcl2cdk.parseProviderRequirements(hcl);
const targets = Object.entries(providerRequirements).map(([name, version]) =>
ConstructsMakerProviderTarget.from(
new config.TerraformProviderConstraint(`${name}@ ${version}`),
LANGUAGES[0],
),
);
// Get all the provider schemas, making the conversion more precise
const { providerSchema } = await readSchema(targets);
const mainTs = await hcl2cdk.convert(hcl, {
language: "typescript",
providerSchema: providerSchema,
});
await hcl2cdk.convertProject(
hcl,
mainTs.code,
require("../cdktf.json"),
{ language: "typescript", providerSchema }, // Currently we only support Typescript for project conversion
);
})();
This transforms your Terraform project into a CDK for Terraform project, besides the resource naming within Terraform the deployed resources should not differ between terraform plan
and cdktf plan
.
If your HCL includes providers that are not mentioned under required_providers
we infer the name, e.g. if you use the datadog_dashboard
resource we infer the provider datadog
which is right, but the namespace is missing, for DataDog it would be datadog/datadog
. Instead we will try to use hashicorp/datadog
and fail because this provider is not known to the registry.
Please see the required providers docs for more information on how to specify providers.
We don't move modules or files for you, if you reference local modules you have to move them so that the relative paths are correct. If you want to make use of files you need to wrap them in a TerraformAsset
before using them.
We have two types of test cases, one within lib
that are on the unit level and one within test
that are testing the entire package at once by converting and then synthesizing the resulting code.
In general, both test types can be run by npx jest <pathToTestCase>
. You can add -u
to update the snapshots and --watch
to run the tests in watch mode.
To make the tests inside test
faster we disable synthesizing and multi-language snapshots by default. You can enable them by setting the envinronment variable CI=true
. Another way of improving the performance significantly is setting the TF_PLUGIN_CACHE_DIR
to a valid directory in order to cache the provider binaries used within the tests. E.g. by running TF_PLUGIN_CACHE_DIR=(mktemp -d) npx jest <pathToTestCase> --watch
.
0.21.0
Breaking Changes
Since long-term support for Node.js 18 has ended, we updated our minimum compatible node version to 20.9.
FAQs
Transform HCL into CDK
The npm package @cdktf/hcl2cdk receives a total of 112,897 weekly downloads. As such, @cdktf/hcl2cdk popularity was classified as popular.
We found that @cdktf/hcl2cdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.