DevSecOps › Module 6 › Lesson 2
Terraform Hygiene
Terraform hygiene literacy — remote state, least-privilege IAM, variable secrets, module pinning, plan review — hygiene rows on YOUR `$DEVSEC_LAB` stubs.
Visual · t36_terraform_hygiene
Terraform hygiene = named config rows. $DEVSEC_LAB. Original Cyberlium.
Opening
Terraform hygiene prevents IaC incidents — name state, IAM, and module pinning rows on YOUR lab stubs before pushing unreviewed plans to prod.
Terraform hygiene literacy names: remote state with encryption category, least-privilege IAM role category, sensitive variable handling category, module version pinning category, and plan review gate category. Analyst writes Terraform hygiene checklist on `$DEVSEC_LAB` stub from 6-1 — five rows with pass/fail criteria literacy — without storing state in public buckets, without admin IAM on lab runner stubs, without committing `.tfvars` secrets. Cyberlium teaches professional IaC hygiene on YOUR notes — shift-left literacy only. Refused: public state buckets, wildcard IAM, secret-in-repo, stranger org Terraform apply. Lab row: Terraform hygiene checklist (five rows, pass/fail criteria, UTC).
1. Named hygiene rows
Remote state, least-privilege IAM, variable secrets, module pinning, plan review — five literacy anchors.
Each row has pass/fail criteria — not subjective 'looks fine.'
Command guide
Try these commands — Named hygiene rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
GitHub Actions security — https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions Gitleaks action — https://github.com/gitleaks/gitleaks-action Bridgecrew Checkov action — https://github.com/bridgecrewio/checkov-action
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
export DEVSEC_REPO=${DEVSEC_REPO:-$DEVSEC_LAB/sample-repo}
cat > "$DEVSEC_REPO/.github/workflows/security.yml" <<'EOF'
# YOUR lab CI security stub — literacy only; pin SHAs before real use
name: DevSec Lab Security Scan
on:
push:
branches: [main, lab]
pull_request:
permissions:
contents: read
jobs:
secret-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Gitleaks detect
run: |
echo 'Stub: gitleaks detect --source . --verbose'
echo 'Install gitleaks in CI or use gitleaks-action with pinned SHA'
iac-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Checkov IaC
run: |
echo 'Stub: checkov -d ../iac/ --compact'
echo 'Copy iac/ into repo or use monorepo path in real pipeline'
container-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Trivy filesystem
run: |
echo 'Stub: trivy fs ../container --severity HIGH,CRITICAL'
echo 'Pin aquasecurity/trivy-action to commit SHA in production'
EOFCommand — copy this
grep -E 'gitleaks|checkov|trivy|permissions' "$DEVSEC_REPO/.github/workflows/security.yml"
python3 -c "print('security.yml stub: gitleaks + checkov + trivy jobs — pin SHAs before prod')"Primary tools to practice this lesson: grep, python3. Reference sites: GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions); Gitleaks action (https://github.com/gitleaks/gitleaks-action); Bridgecrew Checkov action (https://github.com/bridgecrewio/checkov-action). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Plan review discipline
Plan output reviewed before apply on lab stub — document UTC on checklist.
Link Module 3 permissions/pinning rows — same pipeline hygiene thread.
3. Refused
No public state exposure; no admin IAM on CI; no secrets in `.tf` files.
Hygiene literacy supports safe IaC — not checkbox theater.
4. What you ship: Terraform hygiene checklist
Five hygiene rows + pass/fail criteria + plan review UTC + NEVER public state line.
5. What you record before the next lesson
Terraform hygiene checklist path.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Store Terraform state in public S3 bucket on lab stub because 'it's just training.'
Right
Terraform hygiene checklist from `$DEVSEC_LAB` stub. Next: Checkov Named.
Mission: Terraform hygiene checklist
1) Name five hygiene literacy rows. 2) Pass/fail criteria per row. 3) Plan review UTC stub. 4) Write NEVER public state exposure line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Module pinning — minimum literacy stub?”
Knowledge Check
APPLY: Terraform hygiene literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Secrets in `.tfvars` committed to repo are acceptable.
True or False
Knowledge Check
APPLY: Hygiene checklist includes:
Multiple choice