Gotchas Using Terraform in a Secure Delivery Pipeline
summary
Terraform proves useful but brittle in CI/CD: modules and Terragrunt enable reuse, CircleCI or Atlantis automate plan/apply, and tflint plus kitchen-terraform run checks, but surprises bite — secrets end up in plain JSON state so use remote state and PGP or IAM-backed auth and avoid local workspaces, cache provider plugins to speed CI, lock state during runs, use terraform state mv for refactors, and note that terraform-aws-modules have hundreds of thousands of downloads showing real-world adoption.
AI-written summary · about
chapters (34)
- 0:00Introduction
- 1:12About me
- 2:52Terraform
- 3:28Configuration
- 3:51Running Terraform
- 4:16Why is Terraform important
- 5:13How to get started
- 5:23Challenges
- 5:49Terraform Modules
- 6:58Terraform Workspace
- 7:47Terraform Tools
- 8:18Atlantis
- 8:59Private Modules Registry
- 10:01Summary
- 10:12Common Challenges
- 11:27Different Executions
- 13:14Secrets
- 14:50Password
- 15:41Least privilege
- 15:53AWS best practices
- 16:08Terraform best practices
- 16:56Access control
- 19:13Terraform infrastructure modules
- 20:20Terraform Grant
- 20:57Basic Pipeline
- 21:35Sample Pipeline
- 23:35Terraform can be automated
- 23:57Terraform cannot be placed in a pipeline
- 24:30Terraform problems
- 24:42Refactoring
- 26:25Unlock
- 27:35Code
- 29:18Terraform Apply
- 30:36Final Summary
related talks
01h 00mGotchas using Terraform in a secure delivery pipeline
05mUsing Terraform Safely
11mCommon Pitfalls When Using Terraform and How to Avoid Them
08mLighting Talk: Lessons Learned from Writing Thousands of Lines of IaC
14mLightning Talk: 5 Security Tips for Terraform
31mHow Secure are Your Sensitive Values in Terraform? Common Pitfalls of Scale Factory's Clients
25mSecure Your Terraform Deploys in GitLab-CI with HashiCorp Vault
01h 00mSecurely deploying Infrastructure as Code