• Terraform Weekly
  • Posts
  • Issue #163 - Hacking Terraform State, CI/CD using AWS EKS, OIDC Federation between AWS and GCP

Issue #163 - Hacking Terraform State, CI/CD using AWS EKS, OIDC Federation between AWS and GCP

March 06, 2024

Vultr — Terraform Weekly Sponsor

Articles 📚

[!] Hacking Terraform State for Privilege Escalation

Daniel Grzelak explains very important attack vector - Terraform state file. What can an attacker do if they can edit the Terraform state? The answer should be 'nothing' but is actually 'take over your CI/CD pipeline'.

blog.plerion.com/hacking-terraform-state-privilege-escalation

Enabling CI/CD for microservices using AWS EKS, Github, AWS CodePipeline, and Terraform

Aritra Nag writes a detailed post about utilizing Amazon EKS and describes how Terraform can be employed to create a reusable and efficient pipeline in any AWS account.

blog.playgroundtech.io/enabling-ci-cd-for-microservices-using-aws-eks-github-aws-codepipeline-and-terraform-ee71b7fc0fcd

Provide short-lived credentials using OIDC Federation between AWS and GCP

Frans Caisar Ramadhan describes the usage of AssumeRoleWithWebIdentity and Workload Identity Federation between AWS and GCP to avoid having hardcoded credentials shared amongst resources.

franzramadhan.dev/blog/02-gcp-to-aws-short-lived-credential

Understanding count and for_each loops

This blog post by Marcel Lupo explains the important factors one needs to know when working with Terraform and if you need to create multiple instances of the same resources.

dev.to/pwd9000/terraform-understanding-count-and-foreach-loops-c6i

Building Your Own Blog Infrastructure on AWS LightSail

This article by Owen Rooney teaches you how to deploy WordPress using AWS LightSail using Terraform.

www.rooneycloudtech.com/simplifying-cloud-projects-building-your-own-blog-infrastructure-on-aws-lightsail

Open-source projects 🤩

microsoft/symphony

CI/CD for IaC on multiple orchestrators. It includes modern DevOps practices for IAC such as Main and Pull Request workflows, IaC Code Validation & Linting, Automated Testing, Security Scanning, Multi-environment deployments, modules dependencies and more.

github.com/microsoft/symphony

Feedback ❤️

If you have any feedback you want to share with me or if you want to sponsor this weekly newsletter, please do so by reaching out via Twitter, LinkedIn, or replying to the email.

Remember that sharing is caring, so it will help the Terraform community (and me) if you share this newsletter with your friends and colleagues.

PS: One of the best ways to help Ukraine is https://palianytsia.com.ua/

Glory to Ukraine! 🇺🇦