deploy
Terraform
Infrastructure as code with a plan/apply workflow and a large provider ecosystem.
Path 05 · learning path
Infrastructure as Code Security
Preventing insecure infrastructure changes from reaching production: Terraform security foundations (pinning, state, secrets, least privilege, plan before apply), scanning configuration with Checkov and fixing what it finds, and a merge-request gate with documented exceptions and a baseline.
What you will learn
- Pin Terraform, providers and modules, keep state remote and access-controlled, and keep secrets out of source
- Run Checkov on a deliberately insecure configuration, read the findings, fix them and prove the fix
- Suppress a finding with a reason, in the resource or in .checkov.yaml, and know which one to use
- Gate merge requests on new findings with a baseline, without letting developers route around the check
Before you start
Knowledge assumed
- Terraform basics: resources, variables, plan and apply
- How a merge-request pipeline runs (the CI/CD Engineering path, or equivalent)
Hands-on environment
- Docker, to run Terraform and Checkov from their images
- A GitLab.com project for part 3, or gitlab-ci-local
Each part names what it needs. Nothing has to be installed before part 1.
The path
3 parts, in order
Each part states what it assumes from the previous one, so you can also jump in where your setup already is.
- Part 1 of 3 Start here
Secure Terraform Foundations: Pinning, State, Secrets and Review
The security foundations of a Terraform repository: pinned versions with a committed lock file, remote state with locking and access control, secrets kept out of source, least-privilege plan and apply roles.
- Part 2 of 3
Scan Infrastructure as Code with Checkov
Run Checkov against Terraform with a public database, an open security group and an unprotected bucket; read the 22 findings and why they matter; fix them; then record the rest as documented skips.
- Part 3 of 3
IaC Security in CI/CD: Gates, Exceptions and Baselines
Put Checkov in front of terraform plan: a GitLab CI job on every merge request, a baseline so only new findings fail, a pass/fail policy by check ID, exceptions with reasons, reports in the MR, and branch protection.
Toolchain
Tool profiles used in this path
After the last part
Where to go next
One path picks up where this one stops. It is a suggestion, not a requirement.
- Path 08
Cloud Security Foundations
Identity, network exposure, secrets, audit logs and hardening for a cloud-hosted production workload.