WEBVTT

00:00:01.440 --> 00:00:05.250
Hello, and welcome to the course, Risk Management Strategy with Terrascan.

00:00:05.640 --> 00:00:08.460
My name is Chris Blackden, I'm a DevOps engineer.

00:00:08.680 --> 00:00:09.450
Let's get started.

00:00:10.140 --> 00:00:14.530
So the tool we'll be talking about in this course is Terrascan by Accurics.

00:00:14.740 --> 00:00:18.510
Now Terrascan is a static code analyzer for infrastructure as code,

00:00:18.520 --> 00:00:22.050
allowing you to scan for misconfigurations.

00:00:22.740 --> 00:00:26.460
So to go into a little bit more detail about what is Terrascan,

00:00:26.710 --> 00:00:32.549
let's say you have a resource that you're going to deploy into a cloud like AWS,

00:00:32.840 --> 00:00:37.410
and I'd like to pick on Amazon Web Services S3 offering for this

00:00:37.410 --> 00:00:40.470
because a lot of what you'll hear in the news stories is a

00:00:40.470 --> 00:00:43.950
misconfigured S3 bucket allowed public access to what was

00:00:43.950 --> 00:00:45.650
supposed to be private information.

00:00:45.740 --> 00:00:50.190
So if you have that bucket resource defined in something like Terraform,

00:00:50.200 --> 00:00:54.680
what Terrascan will do is allow you to scan that resource to

00:00:54.680 --> 00:00:57.550
see if there's any misconfigurations and then warn you if

00:00:57.550 --> 00:00:59.660
there's any potential vulnerabilities.

00:00:59.710 --> 00:01:02.130
So for example, in S3,

00:01:02.140 --> 00:01:05.860
if you have a bucket without a public access block

00:01:06.140 --> 00:01:07.910
or without versioning enabled,

00:01:07.910 --> 00:01:10.950
both of which are considered best practices by AWS,

00:01:11.110 --> 00:01:14.440
Terrascan will flag those and then tell you so you can

00:01:14.440 --> 00:01:17.680
remediate them. You can download it right from GitHub. This is

00:01:17.680 --> 00:01:20.800
an open‑source tool, so it's available,

00:01:20.800 --> 00:01:24.450
you can actually go and check it out on GitHub and commit to it

00:01:24.450 --> 00:01:28.490
yourself or contribute to it if you'd like. And what makes this tool

00:01:28.490 --> 00:01:32.160
especially interesting is there's a variety of different ways you can

00:01:32.250 --> 00:01:34.310
incorporate it into your process.

00:01:34.460 --> 00:01:36.780
It runs as either a pre‑commit hook,

00:01:37.120 --> 00:01:40.330
a standalone server that you can make calls against

00:01:40.340 --> 00:01:44.500
as part of your CI/CD pipeline, and it runs as a GitHub action,

00:01:44.510 --> 00:01:46.820
or even just on its own on the command line.

00:01:46.940 --> 00:01:49.830
So this means if you're taking a DevSecOps approach with

00:01:49.830 --> 00:01:51.660
your infrastructure configuration,

00:01:51.730 --> 00:01:54.700
there's a number of different ways you can incorporate Terrascan.