Accurics unveiled a major upgrade to Terrascan, the open source static code
analyzer that enables developers to build secure infrastructure as code (IaC).
The new release ensures Terraform templates avoid common security pitfalls in
popular cloud providers such as AWS, Azure, and Google Cloud Platform. Built-in
extensibility will enable support for other popular technologies such as AWS
CloudFormation, Kubernetes, service mesh and serverless.
The new Terrascan architecture
leverages the Open Policy Agent (OPA) engine from CNCF, which dramatically
simplifies policy definition for developers that want to create custom policies
as well as provides over 500 out-of-the-box policies for the CIS Benchmark.
"The rapid
adoption of Infrastructure as Code is clearly meeting its intended goal: to
help organizations achieve more reliability by programmatically embedding
policy checks earlier in the development lifecycle," said Cesar Rodriguez, head
of Developer Advocacy at Accurics. "This is vital in an environment where the
scale and velocity of cloud breaches is constantly increasing, and
organizations are required to implement policy guardrails to ensure that cloud
native infrastructure is securely defined and managed. Terrascan is already
playing a key role in this process within many organizations, and the newest
iteration takes these important capabilities much further."
Terrascan is
now available as a GitHub Action and is included in the popular Super-Linter
GitHub Action. It can be installed as a pre-commit hook to help detect issues
before code is pushed into your repository, and also integrated into the CI/CD
pipeline.
Terrascan
enhances the value of IaC used by organizations to define and manage cloud infrastructure.
It emerged from a search for a scalable way to ensure that cloud infrastructure
was configured in adherence with security best practices. Terrascan has already
been downloaded by hundreds of developers to programmatically scan Terraform code
(IaC) during development in order to track policy violations. It helps identify
issues such as:
- Missing or misconfigured
encryption on resources and communication
- Security Groups left open to
the internet
- Inadvertent exposure of cloud
services
- Insufficient logging for audit
and compliance
Download
Terrascan or learn more at https://www.accurics.com/developers.