Terraform Supply Chain Security
completeEnsuring the integrity of your Terraform workflows — from binary checksum verification and code signing to least-privilege S3 state management.
HashiCorp Terraform AWS S3 Security Supply Chain
Supply chain attacks targeting infrastructure tooling are a growing concern. This project covers the steps needed to verify Terraform binary authenticity, sign your Terraform code, and lock down remote state storage with least-privilege AWS policies.
Posts in this project
HashiCorp Terraform Checksum Verification
How do we verify that the Terraform binary we download is the same as the one HashiCorp produced?
May 17, 2022
HashiCorp Terraform Code Signing
Signing software has become critically important given the recent supply chain attacks. How do we verify that the software we're downloading
May 16, 2022
Terraform AWS S3 State Management Least Privilege
An overview on securing AWS S3 for use a backend for HashiCorp Terraform
October 30, 2017