Terraform Supply Chain Security
completeEnsuring the integrity of your Terraform workflows — from binary checksum verification and code signing to least-privilege S3 state management.
Supply chain attacks targeting infrastructure tooling are a growing concern. This project covers the steps needed to verify Terraform binary authenticity, sign your Terraform code, and lock down remote state storage with least-privilege AWS policies.
Posts in this project
HashiCorp Terraform Checksum Verification
How do we verify that the Terraform binary we download is the same as the one HashiCorp produced?
May 17, 2022
HashiCorp Terraform Code Signing
Signing software has become critically important given the recent supply chain attacks. How do we verify that the software we're downloading
May 16, 2022
Terraform AWS S3 State Management Least Privilege
A very popular Terraform state management configuration is to utilize AWS S3 for state management and AWS DynamoDB for state locking. The pr
October 30, 2017