Terraform in the software supply chain: Modules & providers

This post examines the security risks inherent in Terraform's supply chain, specifically focusing on malicious modules and providers. It details how providers, as executable binaries, can be compromised and discusses the mechanisms Terraform uses for provider verification, such as `zh` and `h1` checksums in the `.terraform.lock.hcl` file. The post highlights the vulnerability of Git tags to mutation, which can be exploited to deliver malicious modules. It provides recommendations for securing the Terraform process, including version controlling the lock file and carefully verifying its contents.