Using Terraform Safely
summary
Terraform has 4,300 modules on GitHub and consuming public modules introduces real risk — an example registry vault module exposes SSH to the world — so establish a formal vetting process and track upstream changes. Terraform routinely outputs secrets, with the private key in the state file appearing in console logs, so encrypt state, scrub CI logs (Jenkins console can leak keys), and evaluate community tools while accepting there is no perfect solution.
AI-written summary · about
chapters (5)
related talks
01h 00mGotchas using Terraform in a secure delivery pipeline
32mGotchas Using Terraform in a Secure Delivery Pipeline
31mTerraform Modules & Providers: Check Your Source
35mTerraform Practices - The Good, the Bad and the Ugly
31mTerraform Structure & Enablement
14mLightning Talk: 5 Security Tips for Terraform
31mHow Secure are Your Sensitive Values in Terraform? Common Pitfalls of Scale Factory's Clients
46mTerraform best practices with examples and arguments