DevSecOps for Infrastructure as Code

This post provides information about building a DevSecOps pipeline for your Infra as Code setup.

📝𝐂𝐨𝐦𝐩𝐨𝐧𝐞𝐧𝐭𝐬 𝐔𝐬𝐞𝐝:

• GitHub Actions: As CI/CD platform.

• HashiCorp Terraform: Tool for Infra as Code.

• 𝐒𝐭𝐚𝐭𝐢𝐜 𝐂𝐨𝐝𝐞 𝐀𝐧𝐚𝐥𝐲𝐬𝐢𝐬 𝐓𝐨𝐨𝐥𝐢𝐧𝐠: GitLeaks for secrets leaks and Checkmarx KICS for security vulnerability and security compliance checks.

• 𝐀𝐮𝐝𝐢𝐭/𝐋𝐨𝐠𝐠𝐢𝐧𝐠 𝐂𝐚𝐩𝐚𝐛𝐢𝐥𝐢𝐭𝐲: Use Opensource Platform like Grafana Loki to ingest your CI/CD pipeline logs.

𝐏𝐫𝐨 𝐓𝐢𝐩: 💡

1. If using GitHub Self hosted runner try make sure they run with 𝐧𝐨𝐧-𝐩𝐫𝐢𝐯𝐢𝐥𝐞𝐠𝐞𝐝 𝐮𝐬𝐞𝐫 and not root.

2. Pin Actions releases with its 𝐒𝐇𝐀 𝐜𝐨𝐦𝐦𝐢𝐭 𝐢𝐧𝐬𝐭𝐞𝐚𝐝 𝐨𝐟 𝐭𝐚𝐠/𝐯𝐞𝐫𝐬𝐢𝐨𝐧.

𝑰𝒏𝒔𝒕𝒆𝒂𝒅 𝒐𝒇 𝒕𝒉𝒊𝒔:

uses: 'actions/checkoutv4’

𝑼𝒔𝒆 𝒕𝒉𝒊𝒔:

uses: 'actions/checkout@<FULL SHA commit>

GitHub Repo Link: https://github.com/iamgp21/database-as-code