Terrascan: Securing Infrastructure as Code

Infrastructure as Code (IaC) has completely changed the course of launching and regulating cloud resources. IaC allows organizations to define and provision infrastructure in a programmatic way with tools like Terraform, CloudFormation, and ARM templates. With great power comes great responsibility. Misconfiguration of IaC files can lead to security vulnerabilities, compliance violations, and operational inefficiencies. That is what Terrascan hopes to tackle.

What is Terrascan?

Terrascan is an open-source static code analysis tool developed by Tenable. It helps detect and prevent security and compliance issues in IaC files. Terrascan supports many IaC frameworks, including Terraform, Kubernetes, Docker, and Helm. Integrating Terrascan into your CI/CD pipeline allows you to automate security checks and enforce best practices before infrastructure is deployed.

Terrascan Key Features

1. Multi-Provider Support: Terrascan has support for a wide variety of providers, including AWS, Azure, Google Cloud, and Kubernetes, making it versatile for multiple cloud environments.
2. Policy as Code: Terrascan uses a library of predefined policies for identifying security risks and compliance violations.  The policies are written in Rego, the policy language used by Open Policy Agents (OPA). You can define custom policies that cater to specific requirements in your organization as well.
3. Scalable and Extensible: Whether you are working alone or with an entire development team, Terrascan will scale with you. The tool's architecture is very modular, which means it would integrate well with other tools, and the functionalities are extendable.
4. CI/CD Integration: Terrascan can seamlessly be integrated with CI/CD pipelines so that the automation of security checks for IaC files as part of the development process becomes possible. Currently supported CIs include GitHub Actions, GitLab CI/CD, Jenkins, and CircleCI.
5. Full Reporting Capabilities: The reports provided by Terrascan are pretty detailed. Issues found in IaC files can be presented to the users, and further export features to formats such as JSON, YAML, and HTML allow easy sharing among relevant stakeholders.

How Terrascan Works

Step 1: Install Terrascan

For installing Terrascan according to your underlying OS, refer to their official website at,

https://runterrascan.io/docs/getting-started/#native-executable

Step 2: Scan IaC Files

Run Terrascan against your IaC files to find security and compliance issues. For example, scan a Terraform directory:

terrascan scan -i terraform -d /path/to/terraform/files

Step 3: Review the Report

Terrascan will provide a report on the findings. The report will detail the severity along with the specific IaC resource and remediation recommendation.
Find the sample report below,

Step 4: Integrate into CI/CD Pipeline

Integrate Terrascan into a CI/CD pipeline by adding a step running Terrascan. Fail the pipeline when critical issues are found. This is an example of GitHub Actions workflow:

Name: Terrascan CI
on: [push, pull_request]
Jobs:
  terrascan:
    runs-on: ubuntu-latest
    Steps:
      - name: Checkout code
        uses: actions/checkout@v3
      - name: Install Terrascan
          run: |
          curl -L "$(curl -s https://api.github.com/repos/tenable/terrascan/releases/latest | grep -o -E "https://.+?_Linux_x86_64.tar.gz")" > terrascan.tar.gz
          tar -xf terrascan.tar.gz terrascan && rm terrascan.tar.gz
          install terrascan /usr/local/bin && rm terrascan
          terrascan
      - name: Run Terrascan
        run: terrascan scan -i terraform -d ./

Common Use Cases

1. Identifying Misconfigurations: Terrascan can detect common IaC misconfigurations, such as publicly accessible storage buckets, unrestricted security group rules, and hardcoded sensitive information.
2. Enforcing Compliance: Organizations can use Terrascan to enforce compliance with standards like CIS Benchmarks, GDPR, HIPAA, and SOC 2.
3. Shift-Left Security: By integrating Terrascan into the development process, teams can identify and fix security issues early, reducing the cost and effort of remediation.

Best Practices for Using Terrascan

1. Keep Policies Updated: Regularly update Terrascan’s policy library to ensure you’re checking against the latest security and compliance standards.
2. Define Custom Policies: Tailor Terrascan’s rules to align with your organization’s security posture and regulatory requirements.
3. Automate Everything: Integrate Terrascan into your CI/CD pipeline to ensure consistent and automated security checks.
4. Collaborate Across Teams: Share Terrascan's findings with developers, security teams, and compliance officers in order to create a culture where everyone is responsible.

Conclusion

Terrascan is the gold standard of IaC security. With its capability to automate security checks and enforce best practices, it enables organizations to build robust, compliant cloud infrastructure. Whether you are a developer, DevOps engineer, or security professional, Terrascan empowers you to proactively address security risks and drive better outcomes.

Start using Terrascan today to secure your IaC and start ensuring a safer, more resilient cloud journey!