DevSecops for Terraform

So there are different ways for securing a terraform :

1. Best pracitces (these are the best practices which we have used in git )
   -> .gitignore
   -> Pre- Commits
   -> Git leaks CI/CD pipeline
2. Chechkov
   -> in company there is a situation where a junior devops engineer created a s# buvket and made it public and then our developer put sensitive information or logs in that bucket then now it will be vulnerable to everyone and anyone can access that this is called as terraform misconfiguration or insecure configuration

These are the example of insecure terraform configuration.

• > now to overcome this situtation we will run checkov in our
  -> so first we need to install checkov
  cmd : pip install checkov
• then we will run checkov
  ->cmd : checkov -d .
• whenever we try to push or commit the changes then checkov validates the configuration.

1. Vault ->

eg: If we are facing a situation like this [“long-lived credentials” means authentication credentials that remain valid for a relatively long time — often months or until you manually revoke them.]

-> Now if a situation is created like someone from the internal team has leaked the credentials beacuse it saved in the same bot account and also the credentials have been stored for long period of time then in that case we will use harshicorp vault .

-> now to solve this problem we will use some secret management steps:
1) short lived credentials and it should be only avaliable for 15–15 min till we are using CI
2) here is the simple architecture:

Git -> Clone -> Update -> Push ( a junior devops engineer clone the repository and pushed it to the git

Git Hub Actions -> AWS -> Vault

Get Afaqueplayer’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Git hub actions will take credentials from the vault and then it will create resources in AWS .

Note : OIDC is a way for GitHub to prove its identity to AWS without storing a permanent AWS access key and secret key.

basically the
Github Actions -> ask OIDC for crdentails to take from vault -> vault ( it will be stord in k8s or Ec2 Instance ) → vault will create short lived IAM users and send it back to git hub actions.

Conclusion : git hub actions uses OIDC to interact with harshicorp vault and get temporary credentials.

• > so role of harshicorp is not just secret management system for storing the credentials it is also used for solving the problems of long lived credentials also .

3) Now we will perform the practicals and the steps are as follows :

-> create an instance named with vault server
->then connect with the instance
->sudo apt update
-> sudo apt install -y unzip wget
-> now we will install vault package
->cmd : vault server -dev -dev-root-token-id=”root” -dev-listen-address=”0.0.0.0:8200"

-> now the server is running on port 8200 we will have to change security group of 8200 and then we will run the server.

• > now we will run
  cmd: vault secret enable aws
• ->we will create a role in that
  cmd: vault write aws/config/root \
  access_key=”AKIA…” \
  secret_key=”SECRET…” \
  region=”us-east-1"
• -> now we will enble OIDC on this server
  cmd : vault auth enable jwt
  -> we are doing this beacuse we want OIDC to connect github actions with the vault which only OIDC can do it .
• -># Configure OIDC connection
  vault write auth/jwt/config \
  oidc_discovery_url=”https://token.actions.githubusercontent.com" \
  bound_issuer=”https://token.actions.githubusercontent.com"
• https://github.com/iam-veeramalla/DevSecOps-Zero-to-Hero/blob/main/03-IaC/02-Vault.md
• after that we will run CI pipeline in gut hub actions and S3 bucket and IAM user will be created in AWS account for short time of span.