Posted on

How to Fix the 5 Most Common AWS IaC Misconfigurations [Webinar Sign-up]

Infrastructure as code (IaC) is critical for developing cloud-native applications at scale, but with added complexity comes added security considerations. If gone undetected, one IaC misconfiguration can snowball into hundreds of alerts and cloud risk. 

In this talk, we analyzed the most common AWS misconfigurations within Bridgecrew’s IaC scan data to illustrate the importance of IaC security. We’ll walk through each of the misconfigurations, the potential risk they pose, and show how to fix them.

Posted on

AWS Cloud Development Kit (CDK) for Terraform: Enabling TypeScript and Python Support

It’s not a leap to propose that Terraform is the DevOps cornerstone for Infrastructure as Code (IaC). Terraform’s adoption since its mid-2014 release to the software development landscape has been meteoric. More than 8000 organizations are using Terraform for infrastructure automation.

To successfully use the IAC tool, it’s important to optimize HashiCorp Configuration Language (HCL). HCL has become one of the most popular languages on GitHub. Typically though, it’s preferable to work with a familiar programming language rather than learning a new one. The good news here is that the Terraform community, in collaboration with AWS Cloud Development Kit (CDK), recently announced the support of TypeScript and Python for provisioning infrastructure using Terraform. Developers can leverage these languages to optimize the IaC’s tools for many providers and modules.

Posted on

A Guide to Open-Source IaC Testing

Introduction

Over the past several years, Infrastructure-as-Code (IaC) platforms, such as Terraform, CloudFormation, and Kubernetes, have rapidly gained traction as the preferred mechanism to provision and manage cloud infrastructure. And for good reason.

It wasn’t that long ago that ClickOps was the dominant approach for cloud management. Everyone is sympathetic to the need for agility when there is a business-critical change required. “Just log onto the console” can seem like a perfectly justifiable action. It usually is…until it isn’t.

Posted on

Building Pipelines With Terraform Cloud

Having a robust and effective CI/CD pipeline is the key to shorter sprints and effective iterations of cloud-native applications. In order to push updates regularly and successfully, you have to incorporate a number of things into the pipeline, including testing and security.

Terraform is used to build, maintain, and update cloud infrastructure. It runs from your desktop and communicates directly with cloud service providers like AWS.

Posted on

Testing Your Code on Terraform: Terratest

Infrastructure as Code (IAC) is more than just a paradigm. Developers are now able to deploy the code they have written on a capable cloud infrastructure without having to configure the cloud environment and provision resources manually. With the help of frameworks like Terraform, deploying supporting cloud infrastructure is as easy as writing a few lines of code.

As with other code constructing the app, however, infrastructure code can have faults and may cause errors. The need for improved testing—including testing the resulting infrastructure itself—is growing rapidly. For the longest time, developers relied on manual testing for the ‘solution’—but that comes with its own set of inherent problems: it’s time-consuming, inefficient, and error prone. Terratest mitigates many of the issues in manual testing.