terraform
Safeguard articles tagged "terraform" — guides, analysis, and best practices for software supply chain and application security.
31 articles
How Snyk IaC handles Terraform modules and remote module ...
How Snyk IaC statically parses Terraform, resolves local modules inline, and why remote Registry or Git modules stay unexpanded until a Terraform plan is scanned.
IaC Drift: The Gap Between Declared and Actual Cloud Conf...
IaC drift lets your cloud diverge silently from Terraform state, breaking the compliance guarantees teams assume are still true. Here's how it happens and how to catch it.
GCP Terraform Provider Security Review
A security-focused review of the Google Terraform providers: provenance, authentication paths, state handling, and the misconfigurations that consistently produce incidents across the Google and Google-Beta provider ecosystem.
Terraform Provider Verification: Securing Your Infrastructure as Code Supply Chain
Terraform providers are plugins that execute with full access to your infrastructure credentials. Verifying their integrity is not optional.
Infrastructure as Code Security: Scanning Terraform, CloudFormation, and Kubernetes Manifests
IaC scanning catches misconfigurations before they reach production. This guide covers tools, techniques, and integration patterns for Terraform, CloudFormation, and Kubernetes.
Terraform Security Scanning: What to Scan, When, and How
A practical guide to integrating security scanning into your Terraform workflow without destroying developer productivity.
Securing Terraform Infrastructure as Code: A Practitioner's Guide
Your Terraform code defines your production infrastructure. If an attacker compromises your HCL files, state files, or provider plugins, they do not just get access — they get the keys to rebuild your entire environment on their terms.