IaC Security Scanning
Infrastructure as Code makes your cloud configuration reviewable, but it doesn't stop you from writing misconfigurations. In this lab, you'll use terraform-compliance to scan existing Terraform code for an S3 bucket. You'll save a Terraform plan, write a plain-English BDD test that requires encryption at rest, watch it fail, then fix the code and run the scan again until it passes. It's the same kind of check you can add to a CI/CD pipeline to stop insecure changes before they reach AWS.
- 8 guided tasks
- Terminal in the browser
Scenario
Misconfigured cloud resources are the most common cloud vulnerability, and Infrastructure as Code does not stop us from writing them. In this lab, you'll scan existing Terraform code for an S3 bucket with terraform-compliance. The scan finds that the bucket has no encryption at rest, and you'll fix the code until the test passes.
What you will learn
- Explain how IaC security scanning finds misconfigurations in Terraform code.
- Install terraform-compliance in a Python virtual environment.
- Save a Terraform plan to a file with terraform plan --out.
- Write a BDD feature that requires S3 encryption at rest and run it against the plan.
- Fix the Terraform code and confirm that the test passes.