Category
Terraform, Ansible, Helm and reproducible infrastructure. 3 articles.
Put Checkov in front of terraform plan: a GitLab CI job on every merge request, a baseline so only new findings fail, a pass/fail policy by check ID, exceptions with reasons, reports in the MR, and branch protection.
Run Checkov against Terraform with a public database, an open security group and an unprotected bucket; read the 22 findings and why they matter; fix them; then record the rest as documented skips.
The security foundations of a Terraform repository: pinned versions with a committed lock file, remote state with locking and access control, secrets kept out of source, least-privilege plan and apply roles.