Tag
8 items tagged Terraform.
Human and workload identities and the credentials that carry them: why static keys are dangerous, how a bound short-lived token differs from a legacy one, how CI assumes a role without a key, and how to scope each one.
Deciding what a cloud workload exposes: public and private subnets, security groups that reference each other instead of address ranges, egress control, TLS and DNS, proven with connection tests on a three-tier layout.
Put Checkov in front of terraform plan: a GitLab CI job on every merge request, a baseline so only new findings fail, a pass/fail policy by check ID, exceptions with reasons, reports in the MR, and branch protection.
Run Checkov against Terraform with a public database, an open security group and an unprotected bucket; read the 22 findings and why they matter; fix them; then record the rest as documented skips.
The security foundations of a Terraform repository: pinned versions with a committed lock file, remote state with locking and access control, secrets kept out of source, least-privilege plan and apply roles.