aztfy VS terrascan

Aztfy is a tool developed by Microsoft that allows you to bulk import resources, it has some configuration so you can specify what to import, the names to import and so on. After spending some time with the tool, I quickly realized it may be a no-go. The problem I had with this tool is twofold:

Azure Terrafy is a tool that makes it easy to import your existing Azure resources into Terraform modules. Suppose you're an Azure user looking to manage your infrastructure with the power of Terraform. In that case, Azure Terrafy can save you time and effort by automating the process of incorporating your existing resources into your Terraform configuration. This is especially useful for those who have a "brownfield" environment, where their infrastructure already has a number of existing resources that need to be brought under the management of Terraform. It can save you a lot of time and effort. Without Terrafy, you would need to manually create a Terraform configuration file for each resource you want to manage. This can be tedious and error-prone, especially if you have many resources.

If that existing infrastructure happens to be in Azure, look into aztfy, it's helped me build some structures to replace first-generation hand-deployed resources.

Azure Terrafy

https://github.com/Azure/aztfy I've done this, as the guy above says it's all flat but perfectly readable.

Aztfy (Azure only): https://github.com/Azure/aztfy

Basic GitOps:Atlantis - https://www.runatlantis.io/

DRY wrapper:

"Reverse"/creating from existing cloud resources:Terraformer: https://github.com/GoogleCloudPlatform/terraformerAztfy (Azure only): https://github.com/Azure/aztfy

2. Terrascan: https://github.com/tenable/terrascan Terrascan detects security vulnerabilities and compliance violations across your IaC. Supports multiple cloud providers, ensuring that your infrastructure complies with security best practices.

Terrascan Owner/Maintainer: Tenable (acquired in 2022) Age: First release on GitHub on November 28th, 2017 License: Apache License 2.0

‍Terrascan is a static code analysis tool that scans your Infrastructure-as-Code (IaC) for security vulnerabilities and compliance violations. It supports multiple platforms like (AWS, Azure, GCP, K8s, Atlantis, etc), including Terraform. Terrascan allows you to enforce security best practices, compliance policies, and governance across your IaC deployments.

Terrascan could also be useful : https://github.com/tenable/terrascan

Terrascan - Scan for Infrastructure-as-Code vulnerabilities

(https://runterrascan.io/) They seem to like it, don't have a ton of my own experience though.

Nessus Expert - newer offering. Nessus Pro + terrascan + basic external attack surface mapping. Doesn’t scan from the internet, but shows you all your public domains, DNS, etc so you can pick what you want to scan/ fix

It is always a good practice to scan your Kubernetes deployment or Helm chart before deploying. We can use Checkov to scans Kubernetes manifests and identifies security and configuration issues. It also supports Helm chart scanning. We can also use terrascan and kubeLinter to scan the Kubernetes manifest.