Securely deploying Infrastructure as Code
summary
Demonstrates how to automatically scan Terraform with tfsec, terrascan, checkov, surface results in PRs via JUnit uploads, and block bad commits with pre-commit hooks and VS Code extensions. Shows storing state per environment in AzureRM backends using OIDC to Azure instead of secrets, plus a bash helper that creates app registrations and federated credentials and wires GitHub secrets. Finds real issues (example storage account allowed HTTP in upstream sample), runs in GitHub Actions and devcontainers, with Terrascan action sometimes failing to publish PR output.
AI-written summary · about
chapters (13)
- 0:00Secure IaC deployment intro
- 1:06What is IaC and why secure it
- 3:10Security misconfig risks & compliance
- 5:35Terraform security tooling
- 9:08Pre-commit hooks for early security
- 12:19VS Code IaC security extensions
- 14:54Demo: pre-commit hooks in action
- 26:33Security tools in CI/CD
- 36:15GitHub Actions security scanning
- 38:23Securing Terraform backend & state
- 42:17OpenID Connect for cloud auth
- 53:57Handling plan changes & approvals
- 59:55Closing & Q&A
related talks
37mStatic Code Analysis of Terraform based Infrastructure as Code IaC scripts
50mFrom Code to Compliance: Enforcing Azure Security with Terraform and...
36mTerraform & CI/CD
30mUsing tfsec to Scan Your Terraform Code
50mInfrastructure as Code for Azure with Terraform
45mCatching Commits to Secure Infrastructure as Code
50mTerraform 101: Building Repeatable, Secure Azure Infrastructure
37mInfraCoding with Terraform: Writing Tests for Infrastructure-as-Code