So let's start here in the Terrascan documentation.
I'm actually at runterrascan.io, if you'll see up here in the address bar,
and this is the homepage for the Terrascan tool.
And we have a couple of different options here.
If I go over to the GitHub page, for example,
this is the source code for Terrascan,
and you can get a few things here like instructions on how to install or
scan with it or even integrate it into other processes.
I'm going to go ahead and leave this alone for now.
I'll go back one.
I'll go back to the homepage and go over to Documentation.
And this has got a lot of the same information, plus a little bit extra.
The thing I want to direct you to first though is the
Policies page here on the left‑hand side,
so let's navigate over there.
And then, depending on what kind of resources you're scanning,
there's different policies for each provider.
The code I'm going to be scanning is some AWS resources,
so I'm going to go ahead and navigate to AWS Policies.
And you see there's a bunch of different policies here for
each type of resource you want to create.
The one I've got in the demo that I'm going to show you
in just a minute is an AWS S3 bucket.
So if I search for that, I'll see it right here on the side,
and there's a couple of different policies for an AWS S3 bucket.
Take a note of the different reference IDs on the right‑hand side
because this is going to come in handy later on as well.
So with that being said, let's go ahead and switch over to Visual Studio Code.
I'll pause the video here and then come back in just a moment.
So welcome back.
I'm here in Visual Studio Code in the Terrascan demo repository.
And I'll have a link to this at the end of the slides,
so if you want to follow along during,
I'd say go ahead and skip to the last slide of this module
and you get a link to this repository,
as well as all the instructions I'm using here.
But I've got a couple of things going on here.
First, I've got some data sources for the aws_caller_identity and in aws_kms key.
The caller_identity's a personal preference,
I like to put that in my bucket resources so that I
can guarantee unique bucket names,
but the KMS key is something that we need to encrypt the bucket,
which I've done in the bucket resource on the block starting on line 14.
Right now, I'm using a private ACL, I've got server‑side encryption enabled,
and then at the bottom here, I've got a public access block.
So, so far this seems like it's in pretty good shape.
Let's go ahead and open up a terminal here.
Now,
the first thing I want to do is install Terrascan so that I can start using it.
And I'm going to go ahead and do this on the command line,
just install the binary for it, but if you prefer,
there's other methods of installing this as well that
are explained in the repository.
So let's go over here, I've got to README file here,
there's two different commands to install Terrascan,
one for macOS and the other for Linux.
So I'm running this on Linux, I'll go ahead and copy that and then run this.
That's done, it's installed now.
And you'll see the first thing it did is it ran a Terrascan with no flags.
There's a couple of different commands here for us to use.
Some of these I'll cover a little bit later on,
but the first thing I want to do is run a terrascan init.
That doesn't have to be done all the time,
what it's going to do is it's going to just copy the latest
policies from the Terrascan GitHub repository.
And when working with a code scanning tool,
you want to make sure that you have the latest and greatest policy definitions,
just so if there's an update that addresses some sort of
vulnerability that's been discovered, you make sure you have that in place.
So now that I've got that set up, let me clear my screen,
and I'll go ahead and I'll run a terrascan scan command.
So you see it flagged me on a couple of things,
Terrascan found two issues here,
one for S3 access logging and the other for S3 versioning,
and both of those are in the root module at the
resource that starts on line 7 in main.tf.
So let's go back to main.tf,
and I'll go ahead and see this is my AWS S3 resource that starts on line 7.
So one of these I'm interested in fixing and the other one I'm not.
Obviously, the bucket versioning is something I want to turn on,
that's quick and easy.
I will go ahead and add a new block here.
All right, so now versioning is enabled on this bucket,
and let's go ahead and we'll run that scan one more time.
You see now I've just got the access logging violation left,
the S3 versioning violation is no longer present.
This one, in particular,
I'm not interested in fixing because I don't want to
set up another bucket for logging.
This is just for demo,
I would not recommend you set it up this way in your production environment.
This is just for demo purposes.
I want to skip this check without actually adding the
requisite Terraform block in place.
So the first thing I'll need to skip this is back in the documentation,
I'll need to get the rule ID.
I'll pause the video here and go back to the docs page.
All right, I'm back here in the policies documentation at runterrascan.io,
and the rule I'm interested in skipping is this one right here,
Logging and Monitoring.
Ensure that S3 buckets have access logging enabled.
If we want to actually skip this in the code,
we want to copy this ID here,
and then we'll need that for the next step so let's copy that
and we'll go back to Visual Studio Code.
Okay, so I'm back here in Visual Studio Code,
and I've got my AWS S3 bucket resource,
and if I wanted to skip the check on that resource,
I'm going to add a new comment in here with the syntax ts:skip=,
and then paste in the rule ID we just copied.
Now, this will tell Terrascan that we want to skip this rule.
You can add one of these lines for each rule you want to skip.
But the other thing I would recommend you do with each of these is make sure
you leave a little comment as to why it's been skipped so that if your code
gets reviewed or there's some sort of audit,
there's a justification for why this rule has been skipped in the first place.
I'm going to go ahead and put in don't want a logging bucket on the demo.
And then I'll save that, and let's rerun Terrascan and see what happens.
So our scan's complete.
You see we have no violated policies here.
And if I expand the window a little bit,
you'll see it does list it as a skipped violation,
but it's not going to count that against us.
So that's Terrascan from the command line.
Let's take a look at some other ways we can run it.
See you then.