Deploying Terraform Enterprise in a Highly Secure Environment at Morgan Stanley
summary
Morgan Stanley deploys Terraform Enterprise inside private subnets by converting all access to outbound only, using an API-driven pipeline that pulls committed code from the VCS, runs a Lambda to assume roles and inject temporary STS credentials into workspaces, then starts runs via the TFE API. The build removes long-lived keys so credentials never exposed, enforces PR/speculative runs and merge-only production deploys, and preserves audit/logging through proxies; the solution is reusable and is reported to work in production.
AI-written summary · about
chapters (7)
- 0:00Introduction to talk
- 1:47Why Terraform Enterprise
- 6:04Security challenges overview
- 8:35Credential management solutions
- 12:54Architecture and workflow
- 17:26Security and scalability details
- 19:11Summary and future plans
related talks
29mCompliance At Scale: Hardened Terraform Modules at Morgan Stanley
29mInfinity and beyond: Scaling Terraform for the global enterprise
26mUsing Terraform Enterprise to Support 3,000 Users
19mSynchronization of Infrastructure Provisioning & Application Deployments
32mGotchas Using Terraform in a Secure Delivery Pipeline
35mTerraform-Powered Platform-as-a-Service
01h 00mGotchas using Terraform in a secure delivery pipeline
05mUsing Terraform Safely