terraform-security.md

Terraform Security Review Checklists

1. Are you storing your Terraform Code in a version control system (Git or similar)?
2. Is Terraform using a separate service account in your cloud infrastructure?
3. Are you using one Terraform workspace for each environment of a given infrastructure component?
4. Are you using Terraform modules to increase reusability of your infrastructure code?
5. Terraform state:
   1. Are your Terraform state files encrypted at rest?
   2. How are your Terraform state files protected against accidental disclosure?
   3. How are your Terraform state files protected against corruption?
6. How do you handle sensitive information in your Terraform scripts?
   1. How are the credentials of a service account used by Terraform secured?
   2. Where are these credentials stored?
   3. Is your Terraform integrated with a secret management tool (HashiCorp’s Vault or similar)?
7. Are the permissions of a service account used by Terraform restricted to minimum?
   1. What is the list of permissions given to the service account used by Terraform?
   2. Are there any separate roles and policies attached?
8. Are you using Terraform Cloud?
   1. How are you running it? SaaS hosted by HashiCorp or a private instance?
   2. Did you assign Terraform Cloud workspace ownership and permissions to your teams?
   3. Did you restrict the Non-Terraform access to cloud provider UIs and APIs to avoid manual infrastructure modifications?

For general advices on how to use Terraform check Terraform Recommended Practices.