Using terrascan to detect compliance and security violations
Over the past several years I've read numerous horror stories about cloud deployments gone wrong. S3 buckets with PCI data left open to the raw Internet, EC2 instance profiles that weren't scoped properly, misconfigured NSGs, etc. It takes a LOT of time to truly understand all the ins and outs of running workloads in the cloud, and making sure you get it "right". This is one reason I'm always on the lookout for tools that can add additional guard rails to the infrastructure provisioning process…
$ read more →Understanding cloud spend in your Terraform workflows
Having worked in the "cloud" for several years, one thing that I'm super conscious about is our cloud bill. There are tons of subtleties associated with billing, such as AZ-to-AZ traffic costs or how VPC endpoints can reduce egress charges. If you utilize Terraform for infrastructure provisioning, you may want to look at infracost. Infracost can help you understand cloud spend for a green field deployment, or what it will cost to expand your existing infrastructure…
$ read more →Using tfswitch to manage Terraform versions
The growth of the Terraform community is absolutely astounding. New providers are constantly popping up, providers are being upgraded at a feverish pace, and amazing new features are constantly being added. With all of this change, deprecations and breaking changes periodically surface. One way to protect yourself from breaking changes is to pin providers and modules to specific versions…
$ read more →How I prepared for, and passed the Hashicorp Certified Terraform Associate certification
I recently passed the Hashicorp Terraform certified associate certification. I've been using Terraform in various capacities for several years, and was stoked when I found out Hashicorp opened this certification to the public. The best part of the certification, the test only costs $70! That is SUPER, SUPER reasonable for a certification exam…
$ read more →Using Terraform for_each statements and dynamic nested blocks to simply AWS security group Ingress statements
Over the past few months, I've been updating various Terraform modules to utilize the new features in 0.12. Among these, is the ability to iterate over dynamic blocks with for_each. Utilizing this new feature has allowed me to reduce the size of my security groups, while making them more readable. To show this feature in action, I will create a new map variable with the port as a key, and a list of CIDR blocks to allow in as the value: To populate the Ingress statements, you can define a dynamic block, and then use for_each to iterate through the map and populate each ingress stanza: The final result will be one or more Ingress statements, each defining the CIDR block source IPs that are allowed to connect to the port: I've been able to drastically reduce the amount of HCL in my custom modules, which is always a good thing…
$ read more →