...
See https://www.terraform.io/docs/language/index.html for an explanation on Terraform files.
Running a terraform scan
Data Theorem’s API can be used to run a terraform scan against a specific terraform configuration file
...
| Code Block |
|---|
export terraform_issues_count=$(curl -X POST 'https://api.securetheorem.com/apis/devops/v1/iac_scans' \ --header 'Content-Type: multipart/form-data' \ --header 'Authorization: APIKey ABCACBA=' \ --form 'file=@"terraform_example_configuration:file.tf"' \ --form 'scan_type="TERRAFORM"'| jq -r ".issues_count") // Then deploy your file only if terraform_issues_count is equal to 0 if [ $TERRAFORM_ISSUES_COUNT == 0 ]; then echo "Deploying file: terraform_example_configuration" else exit 1 |
Integrating into a CI/CD pipeline
GitHub Actions
For terraform files hosted on GitHub, a GitHub Actions workflow can be configured. The workflow will perform terraform scans every time the repository is tagged with a new version.
...
| Code Block |
|---|
name: Data Theorem Terraform Scans
on:
push:
tags:
- '*'
jobs:
datatheorem-terraform-scan:
runs-on: ubuntu-latest
steps:
- env:
DATATHEOREM_WEB_SECURE_SCANS_API_KEY: ${{ secrets.DATATHEOREM_API_RESULT_API_KEY }}
run: |
curl -X POST 'https://api.securetheorem.com/apis/devops/v1/iac_scans' \
--header 'Content-Type: multipart/form-data' \
--header 'Authorization: APIKey $DATATHEOREM_API_RESULT_API_KEY' \
--form 'file=@"terraform_example_configuration:file.tf"' \
--form 'scan_type="TERRAFORM"'
|
Bitbucket Pipelines
For terraform files hosted on Bitbucket, a similar workflow can be configured in Bitbucket Pipelines:
...