Terraform security and compliance
Infrastructure code is an attack surface, and the pipeline that applies it holds the keys to your cloud. Secure the state file and the backend that stores it, get long-lived provider credentials out of CI, keep secrets out of variables and outputs, scan both the HCL and the plan, encode policy as code and gate the pipeline on it, detect drift before an auditor does, and pin the modules you inherit. Twelve lessons, each with real commands and output, ending in a secure Terraform pipeline built end to end.
01
State & credentials
4 lessons01State files are secretsWhat lands in state, and who can read it.25 min02Hardened remote backends & lockingEncryption, versioning, least-privilege state access, and locks.25 min03Provider credentials & least privilegeOIDC from CI instead of long-lived keys; split plan and apply roles.25 min04Secrets in variables & outputssensitive = true is not encryption; where secrets really belong.22 min
02
Scanning & policy as code
4 lessons01Scanning HCL: Trivy (tfsec) & CheckovStatic checks on every change, suppressions with an expiry.25 min02Scanning the plan, not just the codeWhy HCL-only scanning misses things the plan JSON reveals.22 min03OPA policies for TerraformRego rules that block public buckets and open ingress.30 min04Policy gates in the pipelineconftest against the plan, exit codes, and blocking the merge.25 min
03
Drift, modules & delivery
4 lessons01Drift detectionScheduled plans and alerting on out-of-band changes.25 min02Module supply chainPinning, reviewing upstream modules, and what you inherit.25 min03Private registries & version pinningCurated modules, version constraints, and lockfiles.22 min04A secure Terraform pipeline, end to endEverything applied: OIDC, plan/apply split, scan + policy gates, protected state.25 min
Progress is saved in this browser only — no account required.
Final exam
Test yourself on everything
18 questions drawn from all 2 sections — every answer explained as you pick.