Deploy · Infrastructure as code
Terraform
Terraform declares cloud and SaaS resources in HCL, previews changes with plan, and applies them idempotently with state tracking. OpenTofu is the community fork under an open-source license.
On this page
What it does
Provisions infrastructure from declarative configuration with a reviewable plan step and remote, locked state.
Where it fits
Deploy for infrastructure, with Secure checks (Trivy misconfig, tfsec-style rules) on the code before apply.
Quick start
terraform init -backend-config=backend.hcl
terraform fmt -check && terraform validate
terraform plan -out=tfplan && terraform show -json tfplan > plan.json
trivy config . # misconfiguration scan
terraform apply tfplanCommon pitfalls
- State contains secrets; encrypt the backend and restrict access.
- Applying from laptops with long-lived cloud keys — run from CI with OIDC federation instead.
- Unpinned provider versions produce plan drift between runs.
On this site
- Infrastructure as Code Security: a three-part path on pinning, state and secrets, Checkov scanning, and the merge-request gate.
- Cloud Security Foundations: CI roles assumed through OIDC instead of access keys (part 1) and a three-tier network with reference-based security groups (part 2), both validated and scanned.
Articles about Terraform
Cloud Identity and Least Privilege: Humans, Workloads and CI
Human and workload identities and the credentials that carry them: why static keys are dangerous, how a bound short-lived token differs from a legacy one, how CI assumes a role without a key, and how to scope each one.
Cloud Network Security Boundaries: Exposure, Tiers and Default Deny
Deciding what a cloud workload exposes: public and private subnets, security groups that reference each other instead of address ranges, egress control, TLS and DNS, proven with connection tests on a three-tier layout.
IaC Security in CI/CD: Gates, Exceptions and Baselines
Put Checkov in front of terraform plan: a GitLab CI job on every merge request, a baseline so only new findings fail, a pass/fail policy by check ID, exceptions with reasons, reports in the MR, and branch protection.
Scan Infrastructure as Code with Checkov
Run Checkov against Terraform with a public database, an open security group and an unprotected bucket; read the 22 findings and why they matter; fix them; then record the rest as documented skips.
Secure Terraform Foundations: Pinning, State, Secrets and Review
The security foundations of a Terraform repository: pinned versions with a committed lock file, remote state with locking and access control, secrets kept out of source, least-privilege plan and apply roles.