Terraform Modules & Providers: Check Your Source
summary
History: Terraform has 15 providers in 2015, splits providers out by 2017, adds required_providers in terraform 0.13, and the registry grows to ~600 providers with ~400 independent GitHub repos as transitive dependencies. Concrete risks: arbitrary local-exec in modules and malicious provider binaries can exfiltrate env vars or AWS creds during plan/apply. Practical mitigations: gosec grep build from source and verify release checksums, sandbox provider binaries with Little Snitch/OpenSnitch or egress filters, and enforce comptest/OPA policies (or Sentinel) plus provider lockfiles and an allowlist.
AI-written summary · about
chapters (8)
- 0:00Introduction and talk overview
- 2:50Terraform history and growth
- 8:27Providers split and registry changes
- 10:13Threats in Terraform modules
- 13:26Malicious providers risks
- 18:08Security best practices for providers
- 25:12Policy enforcement with OPA
- 28:41Summary and takeaways
related talks
05mUsing Terraform Safely
01h 00mGotchas using Terraform in a secure delivery pipeline
32mGotchas Using Terraform in a Secure Delivery Pipeline
11mCommon Pitfalls When Using Terraform and How to Avoid Them
28mStreamlining Compliance: Leveraging Open-Source Terraform AWS modules
35mPackaging Security in Terraform Modules
31mStreamlining Compliance: Leveraging Open-Source Terraform AWS modules
47mLIVE DEMO: Supply Chain Attacks in the Terraform Registry