Identifying Misconfigurations in your Terraform
summary
Shows how tfsec parses HCL to build a model, runs checks and surfaces concrete fixes: catch an S3 authenticated-read ACL exposure, require encryption on root block devices, enforce IMDS metadata options like IMDS http tokens required, and add organization rules via custom YAML checks for tags. Demonstrates local IDE plugins, a tfsec static analysis CLI workflow, commenting via a GitHub Action on PRs, and optional Aqua run tasks that block runs when mandatory checks fail.
AI-written summary · about
chapters (13)
- 0:00Introduction to misconfigurations
- 1:26What is a misconfiguration
- 2:49Mitigating risks with static analysis
- 4:13How tfsec works
- 6:01Demo setup and installation
- 6:43Running tfsec on Terraform code
- 7:44Fixing issues in the demo
- 9:30Ignoring non-critical issues
- 10:35Custom checks for compliance
- 11:38Integrating tfsec in CI/CD
- 12:39Run tasks and enforcement
- 13:21Real-world impact of misconfigurations
- 13:43Closing remarks
related talks
30mUsing tfsec to Scan Your Terraform Code
29mShifting Terraform Configuration Security Left
37mStatic Code Analysis of Terraform based Infrastructure as Code IaC scripts
01h 00mSecurely deploying Infrastructure as Code
32mGotchas Using Terraform in a Secure Delivery Pipeline
31mStreamlining Compliance: Leveraging Open-Source Terraform AWS modules
14mLightning Talk: 5 Security Tips for Terraform
48mValidate infrastructure, detect drift, and enforce policies with HCP Terraform