Infrastructure as Code Security Audits
Run tfsec and Checkov against a deliberately misconfigured Terraform module, triage and fix the findings, then wire the scan into CI as a required check with a documented, justified suppression for one accepted-risk finding.
Prerequisites: Terraform CLI installed, tfsec installed, Checkov installed (pip install checkov), and a Terraform module with a few resources (the module from the Infrastructure as Code with Terraform project works well).
A misconfigured S3 bucket policy or an overly permissive security group is a security incident waiting to happen — and unlike a code vulnerability, it's often live and exploitable the moment terraform apply finishes, not after a deploy pipeline runs. IaC security scanning catches these misconfigurations in the Terraform plan itself, before any infrastructure exists, which is strictly earlier and cheaper than any runtime detection could ever be.
You'll run two different open-source scanners against the same module — they use overlapping but not identical rule sets, which is itself a useful lesson — fix what's genuinely wrong, and then handle the harder and more realistic case: a finding that's technically true but an accepted risk for a specific, documented reason, which needs a suppression, not a fix.
Test what you just learned
Self-testing is one of the best ways to retain new skills. Unlock project quizzes to check your understanding.
Log in to unlock0 / 6 complete