Gotchas using Terraform in a secure delivery pipeline
summary
Practical pitfalls and fixes for running Terraform in CI/CD: modules vs monolith state, secrets leakage, version upgrades and rollbacks. Key facts: Terraform state is JSON and often sits in S3 so terraform state stored as JSON in S3 can expose secrets; registry hosts ~400+ modules and the most popular AWS modules see >1,000,000 downloads in eight months; Terraform does not auto‑rollback, retries fix many eventual‑consistency errors, and default parallelism is six. Use Atlantis to run plans/applies from PRs and give developers use read-only role for plan while requiring MFA/admin role for apply.
AI-written summary · about
chapters (39)
- 0:00Introduction
- 0:24About Anton
- 2:02Agenda
- 3:04Multitier infrastructure
- 3:43What is Terraform
- 4:41Running Terraform
- 5:34CICD pipeline
- 5:53Typical CICD pipeline
- 6:28How to get started
- 6:52Documentation
- 8:22CI tools
- 9:11Atlantis
- 10:19Russia Corp
- 11:12PreSummary
- 11:28Terraform options
- 13:48Shared directory
- 15:19Secret
- 16:30Password
- 17:42Access Control Principles
- 18:23Access Key and Roles
- 20:35Design Patterns
- 21:14Resource Modules
- 22:03Infrastructure Modules
- 22:46Composition
- 23:20Pipeline
- 24:05Circle CI
- 24:46Modules
- 26:16Tools
- 27:37Infrastructure
- 28:54Telephone problems
- 29:07What is refactoring
- 31:23Terraform upgrade
- 33:53Terraform Atlantis
- 34:51Terraform Pipeline
- 42:00Terraform Circle CI
- 49:17Summary
- 49:53Rollback
- 51:53Testing
- 59:42Questions
related talks
32mGotchas Using Terraform in a Secure Delivery Pipeline
35mTerraform Practices - The Good, the Bad and the Ugly
41mTerraform Practices - The Good, the Bad, and the Ugly
30mTerraform Practices to Enable Infrastructure Scaling
05mUsing Terraform Safely
29mTerraform Practices - The Good, the Bad, and the Ugly
31mTerraform Practices to Enable Infrastructure Scaling
35mMisadventures with Terraform