Security scans for terraform templates
summary
Framework maps CI/CD as an organizational product and shows concrete risks and fixes: misaligned tool choices (Azure DevOps vs S3 vs Artifactory) create sprawl, long retention needs force conservative artifact decisions, and access gaps leave plaintext secrets in pipelines. Uses value‑stream mapping and DORA metrics to measure lead time and recovery. Gives scale examples — 10,000 pipelines, 150 tools, 20‑year retention — and prescribes aligning team topology, artifact ownership, and quality gates so deployment strategies actually work.
AI-written summary · about
chapters (18)
- 0:00Start
- 6:28Environments
- 7:12Branching strategy
- 9:15Delivery strategy
- 12:15Artifacts management
- 14:30SDLC
- 15:17Quality gates
- 16:17Capabilities
- 16:59Constraints
- 19:28Responsibilities
- 19:58Releases
- 20:37Rollbacks
- 22:38DevOps
- 24:41Monitoring
- 25:20Measurements
- 26:11Value Stream
- 27:03Tools
- 28:20Security
related talks
22mSecurity vs Dev Experience Threat … or Opportunity
28mSupport and Tools to Help You Accelerate Toward DevOps
24mTerraform Best Practices
37mStatic Code Analysis of Terraform based Infrastructure as Code IaC scripts
01h 00mSecurely deploying Infrastructure as Code
32mGotchas Using Terraform in a Secure Delivery Pipeline
29mShifting Terraform Configuration Security Left
07mCI/CD Evolution: Ensuring Security and Overview During Rapid Growth