Lightning Talk: 5 Security Tips for Terraform
Lightningat OpenTofu Day North America 2025 · on Monday, 2025-11-10· at 14:55· Building B | Level 2 | B203·
summary
Five concrete practices for OpenTofu/Terraform security: protect state with client-side encryption and cloud-side encryption for S3/DynamoDB and avoid leaking secrets in state or debug logs; use external secret managers like HashiCorp Vault or Azure Key Vault and rotate keys (avoid 380+ day rotations); scan IaC in CI with tools like Checkov/TF cloud scanners integrated into GitLab pipelines; implement policy-as-code with OPA and enforce least privilege and short-lived credentials (zero trust).
AI-written summary · about
chapters (7)
- 0:00Terraform and OpenTofu intro
- 1:44Protect Terraform state
- 3:30Secrets hygiene
- 4:56IaC scanning in CI/CD
- 6:47Policy as code with OPA
- 8:37Privileges and access control
- 10:23Q&A
related talks
08mLighting Talk: Lessons Learned from Writing Thousands of Lines of IaC
31mHow Secure are Your Sensitive Values in Terraform? Common Pitfalls of Scale Factory's Clients
32mGotchas Using Terraform in a Secure Delivery Pipeline
05mUsing Terraform Safely
01h 00mGotchas using Terraform in a secure delivery pipeline
11mCommon Pitfalls When Using Terraform and How to Avoid Them
39mTerraform Practices to Enable Infrastructure Scaling
30mTerraform Practices to Enable Infrastructure Scaling