class

Analyzer::Specification::Terraform

Inherits Analyzer::Specification::SpecificationEngine < Analyzer < FileHelper < Reference < Object

Extracts HTTP endpoints from Terraform / OpenTofu configurations that declare AWS API Gateway routes. Two shapes are covered, mirroring the CloudFormation analyzer:

  • API Gateway v2 (HTTP / WebSocket) — aws_apigatewayv2_route carries a self-contained route_key = "GET /path", so it resolves per file.
  • API Gateway v1 (REST) — aws_api_gateway_resource + aws_api_gateway_method form a reference graph. Terraform merges every .tf file in a module directory into one config, so the graph is resolved per directory, not per file.

Both HCL (.tf) and Terraform JSON (.tf.json) inputs are supported.

Constants

HTTP_METHODS = {"GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "ANY"}
METHOD_ANY = "ANY"
REF_ATTRS = {"parent_id", "resource_id"}
RESOURCE_TYPE_REST_M = "aws_api_gateway_method"
RESOURCE_TYPE_REST_R = "aws_api_gateway_resource"
RESOURCE_TYPE_V2 = "aws_apigatewayv2_route"
TARGET_ATTRS = {"route_key", "path_part", "parent_id", "resource_id", "http_method"}

Attributes the analyzer reads out of a resource body. Everything else is skipped while scanning.

route_key / path_part / http_method are only meaningful as literal strings — a computed value (each.value.method, "${var.path}") can't be resolved statically, so they are captured from quoted strings only. resource_id / parent_id are by nature references into the resource graph, so they are captured from bare expressions too.

Class methods

tech_name
Source

Instance methods

analyze
Source
tech

Instance-side view of the same declaration. The per-file rescues live on this base class, which has no way to name the analyzer that is running inside them, so a skipped file could not be attributed to a tech. Deriving it from analyzer_for keeps the name written exactly once.

Source

Nested types