Terraform Security and Supply Chain

6/1/2022

This post details the security mechanisms for Terraform providers, including the use of SHA256 hashes (zh) for zip files and dirhashes (h1) for provider directories, as recorded in the `.terraform.lock.hcl` file. It explains how these hashes are generated and how attackers could potentially exploit the lock file by adding malicious hashes. For modules, it highlights the vulnerability of mutable Git tags and recommends using specific commit SHAs as a more secure alternative. It also references existing work on malicious Terraform modules and static detection rules.

2/17/2022

This post introduces and details specific security risks in Infrastructure as Code (IaC) management tools, particularly Terraform. It provides a practical example of an S3 bucket vulnerability and demonstrates how to detect it using multiple IaC security scanning tools (tfsec, kics, checkov, terrascan, semgrep, tflint). The post also covers parsing scan reports with `jq` and integrating these scanners into CI/CD pipelines and merge requests. It further suggests using resources like Terragoat for developing and testing IaC security scenarios.

2/15/2022

This post introduces GitLab's Software Supply Chain Security (SSCS) direction and framework, outlining five key aspects: Source, Build, Consumption, Management Process, and Tool Security. It emphasizes the benefits of a single application for SSCS, such as minimizing tools, reducing failure points, enabling seamless interoperability, and simplifying visibility. The post also mentions near-term projects like GitLab Runner Core and highlights the integration with existing capabilities and potential partnerships.

6/10/2021

This post details the integration of Indeni Cloudrail with GitLab CI/CD to automate IaC security checks within the GitOps workflow. It highlights how this integration shifts security left, provides context-based analysis to reduce false positives, and enables developers to remediate security risks instantly, thus accelerating delivery.

9/17/2019

This post introduces the integration of HashiCorp Terraform and Terraform Cloud with GitLab CI/CD. It outlines how Terraform's infrastructure as code capabilities can be used within GitLab's CI/CD pipelines for automated infrastructure provisioning. It also mentions future iterations involving integration with HashiCorp Vault for secrets management.

7/1/2019

This post details a comprehensive DevSecOps workflow for enterprise-grade IaC pipelines using GitLab. It showcases the integration of OpenTofu for provisioning AWS infrastructure and Ansible for deploying a Tomcat web server. Key technical contributions include: building and storing custom Ansible execution environments in the GitLab Container Registry, utilizing GitLab's security scanning for IaC and container vulnerabilities, integrating Ansible linting with GitLab's Code Quality, storing application binaries in the Generic Package Repository, and leveraging CI/CD environment variables. It also demonstrates the use of GitLab's OpenTofu components, Terraform state management, module registry, and OpenID Connect integration with AWS for secure cloud access.