Shifting Terraform Configuration Security Left
summary
Cloud misconfiguration drives most breaches—Rapid7 finds misconfig issues on ~96% of penetration tests—so analyze HCL before apply. The talk shows fast, local static analysis that flags concrete failures, surveys tools like tfsec and Checkov, mentions older Terrafirma and Terrascan rule sets, and demos Conftest using Open Policy Agent rego so policies are unit-testable. Expect many recent open‑source rules, false positives to tune, and easy CI/editor integration to catch issues early.
AI-written summary · about
chapters (12)
- 0:00Introduction to talk
- 1:51Cloud security misconfigurations
- 4:00CIS benchmarks overview
- 6:33Static analysis fundamentals
- 9:25Terraform security issues example
- 11:17Terraform static analysis tools
- 15:11TFSEC tool demo
- 17:18Conftest tool introduction
- 21:19Live tool demonstrations
- 24:00Advantages of early security checks
- 25:24Tooling explosion in Terraform
- 26:10Shifting security left benefits
related talks
14mIdentifying Misconfigurations in your Terraform
22mSecurity vs Dev Experience Threat … or Opportunity
37mStatic Code Analysis of Terraform based Infrastructure as Code IaC scripts
33mSecurity scans for terraform templates
52mApisecure, 14 & 15 March 2023 - Mike McCabe, President at Cloud Security Partners.
37mPlatform and Security Engineering
14mThe power of preventative cloud security with Tenable and
31mStreamlining Compliance: Leveraging Open-Source Terraform AWS modules