This document discusses key steps for ensuring good quality Terraform infrastructure code. It recommends using Terraform validate to check code structure and coherence. It also recommends using TFenv to maintain the right Terraform version. For static analysis, it suggests TFLint to check for issues and best practices, and TFSec to check for security issues. TF-Compliance allows behavior-driven development and compliance checking against Terraform plans. InSpec enables infrastructure verification by dynamically testing expectations against live infrastructure values.

1. Key Steps to a
Good Quality (TF)
Infrastructure
Code
Stephane Jourdan (CloudSkiff)
Cloud Native London (CNCF) - June 2020
@cloudskiff

2. Presentation
● Stephane Jourdan: @sjourdan
● 20 years (Dev)Ops
● Co-founded 3 tech companies (CAN/EU) and 1 sound studio.
● “Infrastructure-as-Code Cookbook” author

3. Teams can safely ship
infrastructure in short cycles
Developers are empowered to make
their code 10x better
Issues with infrastructure as code
are detected before they are
shipped to production
Terraform automation and collaboration
for growing teams
a world where
We envision
@cloudskiff

4. A Ton of Great Tools
But tonight we present only a handful of them.

5. Agenda & Key Takeaways
● Terraform is minimalist in this area.
● Basics: Validate & TFenv
● Static Analysis: TFLint, TFSec
● Check the Plan for Compliance & BDD: TF-Compliance
● Validation: InSpec

6. Basics: Terraform Validate
“Validate” subcommand only checks for
structure & coherence

7. Basics: Terraform Validate
“Validate” subcommand only checks for
structure & coherence

8. Basics: Terraform Validate
“Validate” subcommand only checks for
structure & coherence

9. Basics: Using The Right Terraform
Version
A TF configuration can be perfectly correct
but seen as invalid if Terraform is not the
right version.
Maintaining on CI dozens of versions is a
pain.

10. Basics: Using The Right Terraform
Version
A TF configuration can be perfectly correct
but seen as invalid if Terraform is not the
right version.
Maintaining on CI dozens of versions is a
pain.

11. Complex Matrix Now Enabled!
Infra Name Terraform Version Provider Version
dev latest latest
staging 0.12.25 1.2.3
uat 0.12.24 1.2.2
production 0.12.23 1.2.0
Old Customer #1 0.12.5 1.0.0

12. https://github.com/tfutils/tfenv

13. Static Checks

14. Static Checks (TFLint)

15. Statically Check With TFLint

16. Statically Check With TFLint (Deeper)
Asking the API!

17. Static Analysis With TFLint:
Suggestions
Missed a new AWS instance generation?

18. Static Analysis With TFLint: Best
Practices
Enforce variable typing and documentation
inside the team?

19. TFLint Works With ...
● Terraform
● AWS
● Azure (plugin)
● GCP (soon)
● More to come?

20. https://github.com/terraform-linters/tflint

21. Static Checks (TFSec)

22. Static Checks With TFSec
Checks your Terraform code for security issues.

23. Static Checks With TFSec

24. Static Checks With TFSec

25. Static Checks With TFSec

26. TFSec
● Terraform
● AWS
● Azure
● GCP
● More to come?

27. https://github.com/liamg/tfsec

28. BDD & Compliance
(TF-Compliance)

29. BDD / Cucumber Refresher
Feature: search on Google
Scenario: simple search
Given Enter search term 'CNCF'
When Do search
Then Result is shown for CNCF

30. BDD & Compliance For Terraform
Given I have AWS S3 Bucket defined
Then it must contain server_side_encryption_configuration
Against a terraform plan!

31. BDD with terraform-compliance
Want to ensure all resources have tags?

32. BDD with terraform-compliance

33. BDD with terraform-compliance

34. Terraform-Compliance
● AWS Only (for now)
● Lots of ready to use examples
● Easily extensible
● Security-Oriented
○ KMS
○ Encryption
○ Credentials
○ IAM Permissions
○ Networking
○ Security Groups
● Convention & Compliance
○ Naming Conventions
○ Tags Requirements & Enforcement
○ Forbidden Resources

35. terraform-compliance.com

36. Verification (InSpec)

37. InSpec
Background: RSpec => ServerSpec => InSpec

38. InSpec
Goal:
● A Security Group
○ In a VPC
○ With a specific name
● Simple EC2 instance
○ With a dynamic name
○ Inside the above security group
○ Tagged properly
● …
The related Terraform code
● went through all the linters and
checks in the PR
● It’s now been merged or it’s pending
verification in a sandboxed
environment or staging
● Another team (ie. security) wants to
ensure against reality.

39. InSpec
Filled with variables, references,
constructions, data sources: a lot can go
unexpectedly go right … but the wrong way!

40. InSpec
Simple descriptions and expectations, for
dynamic content:

41. InSpec
Dynamically feed the values and execute
tests!

42. InSpec
Values come from the live Terraform output!

43. InSpec
● AWS
● GCP
● Azure
● Digital Ocean
● Operating Systems
● ...

44. inspec.io

45. Key Takeaways
Spice Up Your Pull Requests in CI!
● Basics: Validate & TFenv
● Static Analysis: TFLint, TFSec
● Check the Plan for Compliance & BDD: TF-Compliance
● Validation: InSpec

46. Join our Beta on cloudskiff.com
Questions?
Thanks a lot!
@cloudskiff