How do we implement Infrastructure as Code (IaC) security scanning in a Terraform environment?

All answers to this question.

For a solid DevSecOps foundation, I highly recommend starting with Checkov or Tfsec. Both are excellent open-source tools that integrate seamlessly into GitLab CI. Checkov is particularly great because it comes with hundreds of pre-defined policies for AWS, Azure, and GCP. You can set it to run on every merge request, and if a developer tries to push a "public" S3 bucket, the pipeline fails immediately. This is the definition of "shifting left." If you need higher-level compliance tracking for SOC2 or HIPAA, then platforms like Bridgecrew or Terraform Cloud's Sentinel might be worth the investment.

   Answered 2024-11-11 by Melissa White

Do you find that your developers ignore the scan results if there are too many false positives, and how do you handle "exceptions" for specific resources that actually need to be public?

   Answered 2024-11-13 by Barbara Miller

• That is a challenge, Barbara. We handle this by using inline "skip" comments in the Terraform code, but only after a senior security engineer reviews the PR. For false positives, we maintain a central 'config' file for Checkov that suppresses specific checks across the whole org. It requires a bit of maintenance, but it keeps the 'noise' down and ensures developers don't just start ignoring the pipeline failures.

     Commented 2024-11-14 by Richard Moore

We use OPA (Open Policy Agent) with Rego policies. It’s a bit of a steeper learning curve than Tfsec, but it allows us to write much more complex, custom business logic for our infrastructure.

   Answered 2024-11-15 by Thomas Garcia

• I agree with Thomas; OPA is incredibly powerful. While Checkov is easier to start with, OPA gives you a unified policy language that can be used for K8s, Terraform, and even Envoy.

     Commented 2024-11-16 by Melissa White