Static Code Analysis of Terraform based Infrastructure as Code IaC scripts
summary
Terraform validate and plan miss runtime and security problems such as invalid AWS instance types and open CIDR /0, so static analysis is essential. The demo runs TFLint (200+ rules) and shows plugin-based checks for AWS/Azure/GCP; TFSec finds 6 issues: 1 critical, 2 medium, 3 low including public ingress and missing client certs; and SonarQube via Docker + sonar-scanner surfaces 12 Azure security issues and 1 AWS vulnerability plus 2 hotspots. Examples include VS Code extensions, Dockerized SonarQube, and how to plug scans into a CI pipeline.
AI-written summary · about
chapters (7)
- 0:00Start
- 1:05Agenda
- 4:27Static Code Analysis
- 7:33Terraform Script
- 15:22Rules for aws Azure and Gcp
- 16:16Demo
- 26:26Sonar Cube
related talks
01h 00mSecurely deploying Infrastructure as Code
30mUsing tfsec to Scan Your Terraform Code
14mIdentifying Misconfigurations in your Terraform
37mInfraCoding with Terraform: Writing Tests for Infrastructure-as-Code
33mSecurity scans for terraform templates
29mShifting Terraform Configuration Security Left
48mWhy checking your infrastructure-as-code for misconfigurations is not enough – How ...
18mInfrastructure as Code Security Best Practices & Strats