The next way I'm going to show you how to use
Terrascan is with a pre‑commit hook.
So this means that if your Infer code does not pass a Terrascan check,
it won't even commit to your local repository.
So for this, you'll need a couple of things installed already.
First is the Terrascan tool, as mentioned earlier,
but you'll also need the pre‑commit framework.
This is a fairly popular framework for managing pre‑commit hooks.
So I'm not going to go into detail on it here,
but you can find more information about it in the README file here on line 23,
Pre‑commit framework.
For now, let's go ahead and open up this .pre‑commit‑config.yaml file.
And I'll do a bit of a deep dive on this one,
so we can understand exactly what's going on here.
What this pre‑commit framework config file is saying is we have a
check that we want to run in the Terrascan repository.
Specifically, we're running against the latest version,
as of this recording, which is version 1.13.0,
and then we're looking for the Terraform pre‑commit hook ID in that repo.
So let's go over to Terrascan and I'll show you what exactly this is doing.
So I'm here in Terrascan, look at the root of the repository,
there's another file here called .pre‑commit‑hooks.yaml. So that
means that the owners of Terrascan, the maintainers of Terrascan,
have already set it up to work with the pre‑commit framework. Let's
go ahead and open this up.
And if you'll remember, the ID for our pre‑commit hook from
our repository was terraform‑pre‑commit.
And what this file is saying is that if we want to run this ID,
the script for it is in the scripts/pre‑commit‑hook.sh file.
So let's go into the scripts directory,
scroll down a little bit here to pre‑commit‑hook.sh.
And this is what is actually running when we run our pre‑commit hook
using the pre‑commit framework. Now you can check this out on your
own if you'd like, but what essentially this is doing is it's setting
up some parameters, and then on line 31, it's running Terrascan with
those parameters.
So I'm not going to go into too much more detail on that, let's go
back to Visual Studio Code and run it for ourselves.
All right, so first things first,
I'm going to, actually, before I even commit anything,
there's something else the pre‑commit framework gives us. If we run
a pre‑commit run with all‑files, that's going to run the job for us
and we see I still have those same infrastructure misconfigurations
that I mentioned earlier,
so it's going to fail. Let's go ahead and clear the screen here, it will
give us a little bit more room to see what's going on. And I'll run a git
status and that will show you that I have made some modifications to the
README.md file that I'm going to commit now.
And because it's going to run this pre‑commit hook
against all of the code in my repository,
this is going to fail.
Let's go ahead and add it, commit it. We got our
message, let's try and commit this.
So you see, it did fail.
If I scroll back up,
you see it did run the Terrascan pre‑commit hook and then it
failed because I still have those infrastructure
misconfigurations. And if I go back and run a git status,
you see my file is still staged,
it hasn't been committed to the local repository.
So you can use this method to block commits that would
introduce vulnerabilities into your repository.
That's it for this video, there's one more way we can set up
Terrascan, and I will show you that in the next section.
I'll see you there.