Using tfsec to Scan Your Terraform Code

As more and more teams are using infrastructure as code to ensure they have consistent, repeatable deployment of infrastructure, it is becoming increasingly important to guard against mis-configurations creeping into the release.

Rough breakdown:
- Introduction to why tfsec exists and the background - 5 minutes
- Scanning your files - with demo
- tfsec advanced features - 10mins
- Custom checks - satisfying your companies compliance requirements
- Ignoring checks - expiry, workspace filtering
- Shifting left - 10mins
- VSCode extension
- GitHub actions
- Questions - 5mins

The attendee will leave with an understanding that there are risks to misconfiguration and they will learn about a tool that can support them. Even if they go on to use another static analysis tool, they will have been prompted to be more vigilant.

Speaker: Owen Rumney
GitHub: @owenrumney
Twitter: @owenrum

HashiCorp provides infrastructure automation software for multi-cloud environments, enabling enterprises to unlock a common cloud operating model to provision, secure, connect, and run any application on any infrastructure. HashiCorp open source tools Vagrant, Packer, Terraform, Vault, Consul, Nomad, Boundary, and Waypoint allow organizations to deliver applications faster by helping enterprises transition from manual processes and ITIL practices to self-service automation and DevOps practices.

Twitter: @hashicorp