Security Practices¶

This template implements multiple layers of security scanning and enforcement to ensure infrastructure code meets security best practices.

Security Scanning Tools¶

Checkov performs policy-as-code scanning against Terraform configurations.

Configuration: .checkov.yml

# Key settings
framework:
  - terraform
  - terraform_plan
quiet: true

Checkov checks for:

Suppressing Findings

Add skip-check entries in .checkov.yml to suppress specific findings when justified:

skip-check:
  - CKV_AWS_XXX  # Reason for suppression

TFLint provides linting with AWS-specific rules.

Configuration: .tflint.hcl

Key rules enforced:

Rule	Purpose
`terraform_required_version`	Version constraint required
`terraform_required_providers`	Provider versions pinned
`terraform_typed_variables`	All variables must have types
`terraform_documented_variables`	All variables must have descriptions
`terraform_documented_outputs`	All outputs must have descriptions
`terraform_naming_convention`	Snake case naming enforced
`terraform_unused_declarations`	No unused variables/locals

The AWS plugin enables cloud-specific checks like valid instance types, deprecated features, and resource configuration best practices.

# Initialize TFLint plugins (first time)
tflint --init

# Run TFLint
tflint --config=.tflint.hcl

Gitleaks detects secrets and credentials in the codebase.

The included S3 bucket module (modules/s3-bucket) demonstrates security best practices:

All resources are automatically tagged via the AWS provider:

default_tags {
  tags = {
    ManagedBy   = "Terraform"
    Environment = var.env
  }
}

This ensures:

The following security hooks run before every commit:

Every PR is scanned by:

Sensitive Data

State File Security