Hello, and welcome to the course, Risk Management Strategy with Terrascan.
My name is Chris Blackden, I'm a DevOps engineer.
Let's get started.
So the tool we'll be talking about in this course is Terrascan by Accurics.
Now Terrascan is a static code analyzer for infrastructure as code,
allowing you to scan for misconfigurations.
So to go into a little bit more detail about what is Terrascan,
let's say you have a resource that you're going to deploy into a cloud like AWS,
and I'd like to pick on Amazon Web Services S3 offering for this
because a lot of what you'll hear in the news stories is a
misconfigured S3 bucket allowed public access to what was
supposed to be private information.
So if you have that bucket resource defined in something like Terraform,
what Terrascan will do is allow you to scan that resource to
see if there's any misconfigurations and then warn you if
there's any potential vulnerabilities.
So for example, in S3,
if you have a bucket without a public access block
or without versioning enabled,
both of which are considered best practices by AWS,
Terrascan will flag those and then tell you so you can
remediate them. You can download it right from GitHub. This is
an open‑source tool, so it's available,
you can actually go and check it out on GitHub and commit to it
yourself or contribute to it if you'd like. And what makes this tool
especially interesting is there's a variety of different ways you can
incorporate it into your process.
It runs as either a pre‑commit hook,
a standalone server that you can make calls against
as part of your CI/CD pipeline, and it runs as a GitHub action,
or even just on its own on the command line.
So this means if you're taking a DevSecOps approach with
your infrastructure configuration,
there's a number of different ways you can incorporate Terrascan.