9/20: The open source version of Terraform is now OpenTofu Sometimes, I write articles even when things don't work. It's about showing a learning process. Using IaC means consistency, and one thing you don't want to do is have 5 open S3 buckets on AWS that anyone on the internet can reach. That's where tools such as Terrascan and Tfsec come in, where we can make our own policies and rules to be checked against our code before we init. What I Did (Short Version) Integrate checks in the pipeline → if it didn’t meet criteria, it wasn’t created with terraform. Reiterated via test failures → If it shouldn’t have been created, I tweaked the check. Maintained consistency → The same naming convention was essential. As this was contract work, I can't show you the exact code used, but I can tell you that this blog post by Cesar Rodriguez of Cloud Security Musings was quite helpful, as well as this one by Chris Ayers . The issue is using Rego; ...
I research and implement products + infrastructure for the Cloud, software, and other interesting things. My tailored Cloud Project Portfolio is at runtcpip.com