WEBVTT

00:00:03.140 --> 00:00:05.000
The next way I'm going to show you how to use

00:00:05.000 --> 00:00:07.450
Terrascan is with a pre‑commit hook.

00:00:07.460 --> 00:00:11.740
So this means that if your Infer code does not pass a Terrascan check,

00:00:11.750 --> 00:00:14.720
it won't even commit to your local repository.

00:00:14.790 --> 00:00:18.020
So for this, you'll need a couple of things installed already.

00:00:18.020 --> 00:00:21.160
First is the Terrascan tool, as mentioned earlier,

00:00:21.240 --> 00:00:23.860
but you'll also need the pre‑commit framework.

00:00:23.870 --> 00:00:27.270
This is a fairly popular framework for managing pre‑commit hooks.

00:00:27.310 --> 00:00:29.640
So I'm not going to go into detail on it here,

00:00:29.640 --> 00:00:34.020
but you can find more information about it in the README file here on line 23,

00:00:34.020 --> 00:00:35.060
Pre‑commit framework.

00:00:35.740 --> 00:00:39.880
For now, let's go ahead and open up this .pre‑commit‑config.yaml file.

00:00:40.040 --> 00:00:42.180
And I'll do a bit of a deep dive on this one,

00:00:42.180 --> 00:00:45.010
so we can understand exactly what's going on here.

00:00:45.160 --> 00:00:49.980
What this pre‑commit framework config file is saying is we have a

00:00:49.990 --> 00:00:54.160
check that we want to run in the Terrascan repository.

00:00:54.440 --> 00:00:57.710
Specifically, we're running against the latest version,

00:00:57.710 --> 00:01:01.250
as of this recording, which is version 1.13.0,

00:01:01.340 --> 00:01:06.800
and then we're looking for the Terraform pre‑commit hook ID in that repo.

00:01:06.800 --> 00:01:11.660
So let's go over to Terrascan and I'll show you what exactly this is doing.

00:01:12.740 --> 00:01:17.090
So I'm here in Terrascan, look at the root of the repository,

00:01:17.090 --> 00:01:21.490
there's another file here called .pre‑commit‑hooks.yaml. So that

00:01:21.490 --> 00:01:25.450
means that the owners of Terrascan, the maintainers of Terrascan,

00:01:25.460 --> 00:01:28.650
have already set it up to work with the pre‑commit framework. Let's

00:01:28.650 --> 00:01:29.960
go ahead and open this up.

00:01:30.110 --> 00:01:33.730
And if you'll remember, the ID for our pre‑commit hook from

00:01:33.740 --> 00:01:36.120
our repository was terraform‑pre‑commit.

00:01:36.240 --> 00:01:40.800
And what this file is saying is that if we want to run this ID,

00:01:40.810 --> 00:01:45.460
the script for it is in the scripts/pre‑commit‑hook.sh file.

00:01:45.650 --> 00:01:48.320
So let's go into the scripts directory,

00:01:48.740 --> 00:01:52.060
scroll down a little bit here to pre‑commit‑hook.sh.

00:01:52.180 --> 00:01:56.320
And this is what is actually running when we run our pre‑commit hook

00:01:56.520 --> 00:01:59.800
using the pre‑commit framework. Now you can check this out on your

00:01:59.800 --> 00:02:03.190
own if you'd like, but what essentially this is doing is it's setting

00:02:03.190 --> 00:02:07.110
up some parameters, and then on line 31, it's running Terrascan with

00:02:07.110 --> 00:02:08.150
those parameters.

00:02:08.440 --> 00:02:11.480
So I'm not going to go into too much more detail on that, let's go

00:02:11.480 --> 00:02:14.060
back to Visual Studio Code and run it for ourselves.

00:02:14.840 --> 00:02:16.490
All right, so first things first,

00:02:16.500 --> 00:02:19.740
I'm going to, actually, before I even commit anything,

00:02:19.780 --> 00:02:23.670
there's something else the pre‑commit framework gives us. If we run

00:02:23.670 --> 00:02:28.590
a pre‑commit run with all‑files, that's going to run the job for us

00:02:28.590 --> 00:02:32.420
and we see I still have those same infrastructure misconfigurations

00:02:32.420 --> 00:02:33.650
that I mentioned earlier,

00:02:33.900 --> 00:02:38.850
so it's going to fail. Let's go ahead and clear the screen here, it will

00:02:38.850 --> 00:02:42.640
give us a little bit more room to see what's going on. And I'll run a git

00:02:42.640 --> 00:02:47.700
status and that will show you that I have made some modifications to the

00:02:47.700 --> 00:02:50.970
README.md file that I'm going to commit now.

00:02:50.980 --> 00:02:54.110
And because it's going to run this pre‑commit hook

00:02:54.110 --> 00:02:56.160
against all of the code in my repository,

00:02:56.340 --> 00:02:57.510
this is going to fail.

00:02:57.600 --> 00:03:02.700
Let's go ahead and add it, commit it. We got our

00:03:02.700 --> 00:03:04.750
message, let's try and commit this.

00:03:06.440 --> 00:03:08.050
So you see, it did fail.

00:03:08.050 --> 00:03:09.010
If I scroll back up,

00:03:09.010 --> 00:03:12.660
you see it did run the Terrascan pre‑commit hook and then it

00:03:12.660 --> 00:03:14.790
failed because I still have those infrastructure

00:03:14.790 --> 00:03:18.860
misconfigurations. And if I go back and run a git status,

00:03:19.840 --> 00:03:21.520
you see my file is still staged,

00:03:21.530 --> 00:03:23.920
it hasn't been committed to the local repository.

00:03:23.920 --> 00:03:27.660
So you can use this method to block commits that would

00:03:27.670 --> 00:03:30.610
introduce vulnerabilities into your repository.

00:03:30.920 --> 00:03:33.780
That's it for this video, there's one more way we can set up

00:03:33.780 --> 00:03:36.390
Terrascan, and I will show you that in the next section.

00:03:36.770 --> 00:03:37.360
I'll see you there.