Packaging Security in Terraform Modules
summary
Snowflake packages security into Terraform modules that enforce secure defaults (KMS on, private VPCs, VPC endpoints), observability packaged (DNS/query logs, Prometheus/Sentry metrics) and provider aliases for RBAC so each resource maps to a granular role. The team builds and ships Jeff (Generic External Function Framework) using the Snowflake Terraform Provider, deploys it across clouds in multiple iterations, and reports real gains: more than 20 duplicate threat models collapse into a single module review and deployments shrink from days to hours.
AI-written summary · about
chapters (9)
- 0:00Introduction to talk
- 2:21Security as a challenge
- 5:43The SDLC security bottleneck
- 8:34Case study: Jeff
- 14:05Packaging security patterns
- 18:07Attack provenance and design
- 20:47Role-based access control
- 27:38Lessons in security speed
- 31:53Future of security as code
related talks
32mGotchas Using Terraform in a Secure Delivery Pipeline
29mCompliance At Scale: Hardened Terraform Modules at Morgan Stanley
39mTerraform Practices to Enable Infrastructure Scaling
05mUsing Terraform Safely
31mTerraform Practices to Enable Infrastructure Scaling
01h 00mGotchas using Terraform in a secure delivery pipeline
14mLightning Talk: 5 Security Tips for Terraform
31mTerraform Modules & Providers: Check Your Source