Catching Commits to Secure Infrastructure as Code
summary
Shows how to parse a terraform plan JSON and fail commits that add 0.0.0.0/0 security rules, using Open Policy Agent Rego policies run as unit tests in CI. Demonstrates a live demo that fails a bad plan then blocks promotion until fixed, plus an EKS example that detects public vs private subnets by querying subnet attributes. Describes continuous validation for drift and version checks across over 400 resources and using scanners like Snyk and Prisma Cloud.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:40OWASP secure coding practices
- 1:26What about infrastructure as code?
- 2:32How do you write secure infrastructure as code?
- 6:15Capture secure knowledge as tests
- 6:40Demo
- 11:49What commits to catch?
- 22:41System configuration
- 27:18Demo
- 34:21There's more!
- 41:10Demo
- 41:36What's important?
- 43:45Conclusion
- 44:44Outro
related talks
01h 00mSecurely deploying Infrastructure as Code
30mEnhance your Compliance with Policy-Based CI/CD
18mImplementing Unit Tests for Terraform with Open Policy Agent
50mFrom Code to Compliance: Enforcing Azure Security with Terraform and...
37mStatic Code Analysis of Terraform based Infrastructure as Code IaC scripts
51mTerraform Cloud Learn Lab: Validate Infrastructure, Detect Drift & Enforce OPA Policies
20mSentinel in action: Policy as code for secure Terraform workflows in HCP
45mStreamlining Compliance: Leveraging Open-Source Terraform AWS modules