THAILAND
AWS Infrastructure Pipeline with Terraform and Pre-commit Check
AWS Community Days 25 January 2025
�Navapon Tantechasa�DevSecOps Engineer
Abacus Digital
Agenda
Start with why ?
Terraform Plan Outputs
Is it up to standard?
Trivy
Checkov
What we are missing
Operation
Security
Problem Statement
Pre-commit Framework
What’s pre-commit
Git hook scripts are useful for identifying simple issues before submission to code review.
Before commit the code point out issue in code such as missing semicolons, trailing whitespace, and this allows a code reviewer to focus on the architecture of a change while not wasting time with trivial style nitpicks.
How to get start
How to configure
Before to make it work
How to make it work
Demo run Pre-commit
Essential Tools Deep Dive
Terraform fmt
Used to rewrite Terraform configuration files to a canonical format and style.
This command applies a subset of the along with other minor adjustments for readability.
Example
Terraform Validate
Validate runs checks that verify whether a configuration is syntactically valid and internally consistent, regardless of any provided variables or existing state.
Example
Terraform Docs
A utility to generate documentation from Terraform modules in various output formats.
Example
Demo run Terraform Docs
Terraform TFLint
TFLint performs automated checks on Terraform configurations to identify potential issues, errors, and violations of best practices.
TFLint helps maintain code quality, consistency, and reliability in Terraform projects
Setup Plugin
Create .tflint.hcl at Root
Install Plugin
Rule Available 700+
Trivy
Use Trivy to find vulnerabilities (CVE) & misconfigurations
Targets (what Trivy can scan):
- Container Image
- Filesystem
- Git Repository (remote)
- Virtual Machine Image
- Kubernetes
- AWS
Scanners (what Trivy can find there):
- OS packages and software dependencies in use (SBOM)
- Known vulnerabilities (CVEs)
- IaC issues and misconfigurations
- Sensitive information and secrets
- Software licenses
Demo run
Checkov
Checkov scans cloud infrastructure configurations to find misconfigurations before they're deployed
Checkov uses a common command line interface to manage and analyze infrastructure as code (IaC) scan results across platforms such as
Demo run
How Trivy and Checkov difference
Infracost
Infracost enables a shift-left approach for cloud costs by providing cost estimates for Terraform before deployment
Demo run
Git Hooks much more to explore
But this will not success�because …
It’s based on individual laptop
Real-world Implementation�Integration with Pipeline
Integration with GitHub Action or Other Pipeline
Secretless with OIDC Workflow
Define Code Owner�
Specific Reviewer for approve change
Create GitHub Rulesets for�
Fast Feedback Loops��
All recommended by tools, Terraform Plan Result or error put to PR Comment
Fast Feedback Loops��
Resource Example Available here
Q&A and Thankyou