defsec VS tfsec

This integration enables hints and warnings when your manifest violates a given policy. Kudos to our friends at Aquasec for sharing their security team’s rules with us. These rules are used in trivy and open sourced through the defsec project and now form part of Monokle, too!

Using pre-commit framework with terraform repository, will help your code to be kept clean, formated, updated document and checked for tf security issues (optional with tfsec) before committing and pushing the code to git source.

Here again more than one tool exists to assist. We will highlight two of the most popular ones here: tfsec and checkov. Both provide a predefined set of checks that they use to inspect your code, allowing to explicitly open exceptions (if you really want to) by annotating your code with comments, and adjust the configuration to ignore some modules, for example.

An additional benefit of using a CI workflow is adding automated tests. In this scenario, I’ve added a step leveraging tfsec to scan for static code vulnerabilities. In the example below, tfsec warns against creating an Azure network security rule which is fully open. This will halt and fail the workflow unless I provide an ignore comment to accept the warning.

· Provision an EKS Cluster (AWS) · Terraform v15.0 · Terraform Registry · Pre-Commit · Terraform Pre-commit · Terraform-docs · Tflint · Tfsec

Using terraform, create a skeleton directory that they can review for how EC2 instances should be created. Use tools like https://github.com/tfsec/tfsec or other scanners/linters to validate that your developers followed this process and didn't uncheck something.

I know tfsec (https://github.com/tfsec/tfsec) which is pretty good for AWS resources but I think vSphere resources are not implemented.

tfsec/tfsec (Go): 🔒🌍 Static analysis powered security scanner for your terraform code