Terraform-Best-Practices

1. Automation
   • Security & Compliance
   • Validation & Formating
   • Testing
2. Version Control
3. CI/CD Automation

Github Actions & CI/CD Integrations

Security and Vulnerability Scanning

Static code analysis tool for infrastructure-as-code.

tfsec

tfsec uses static analysis of your terraform templates to spot potential security issues. Now with terraform CDK support.

Link to github actions

#####checkhov

It scans cloud infrastructure provisioned using Terraform, Terraform plan, Cloudformation, Kubernetes, Dockerfile, Serverless or ARM Templates and detects security and compliance misconfigurations using graph-based scanning.

Checkov also powers Bridgecrew, the developer-first platform that codifies and streamlines cloud security throughout the development lifecycle. Bridgecrew identifies, fixes, and prevents misconfigurations in cloud resources and infrastructure-as-code files.

Link to github actions

Automating Terraform Documentation using terraform-docs

Documentation generated by Terraform-docs

Link to github actions

Terraform fmt and validate checks

Link to github actions

Semantic Versioning hooks

TBC

Directory Structure. Mono VS Multi

DRYing out variables and input variables

- Default values best practices -> look at helm 
- Exiger vs sample

---

Presentation #2

1. Terragrunt vs Terraform
2. Terraform vs Terraform Cloud

Benefits of Terraform Cloud

1. RBAC
2. API Integration for third party applications and systems rather than service account/user based.
3. Workspaces are Collections of Infrastructure
4. Sentinel is an embeddable policy as code framework to enable fine-grained, logic-based policy decisions that can be extended to source external information to make decisions.
5. Easily leverage and integrate with Hashicorp Vault

Policy enforcement: With Sentinel, you can assign policy criteria to all Terraform plans before execution. This allows for enforcement such that only modules from the TFE private module registry can be used; this provides greater control over collaboration and adoption of company policy and/or regulatory requirements.