Increasing the Security Posture of your Pipelines

In this talk, I share lessons learned about increasing the security posture of CI / CD pipelines and how Terraform can help unlock patterns that work at scale.

This version of the talk was given as the opening keynote at devopsdays Ljubljana in September 2023.

Transcript

1. Increasing the Security Posture of your Pipelines
2. Getting the Security Team to stop bothering you daily
3. Sr. Developer Advocate at HashiCorp he / him @ksatirli Kerim Satirli
4. Define the Pipeline ! react to repository events # deal with code quality issues " ensure code quality
5. !!" # when to run this pipeline <trigger> # all the stuff it needs to do <steps> # handle errors other people introduced <more steps> pipeline.yml Define the Pipeline
6. !!" # when to run this pipeline on: push: jobs: # all the stuff it needs to do happy_path: steps: - run: terraform fmt -check -recursive !# terraform validate # handle errors other people introduced sad_path: steps: - if: $!$ failure() !% uses: upload-artifacts terraform.yml Define the Pipeline
7. !!" # when to run this pipeline on: push: jobs: # all the stuff it needs to do happy_path: steps: - run: terraform fmt -check -recursive !# terraform validate # handle errors other people introduced sad_path: steps: - if: $!$ failure() !% uses: upload-artifacts terraform.yml Define the Pipeline
8. !!" # when to run this pipeline on: push: jobs: # all the stuff it needs to do happy_path: steps: - run: terraform fmt -check -recursive !# terraform validate with: version: "1.6.0" terraform.yml Define the Pipeline
9. terraform.yml !!" # when to run this pipeline on: push: jobs: # all the stuff it needs to do happy_path: steps: - uses: "hashicorp/setup-terraform" - run: terraform fmt -check -recursive !# terraform validate with: version: "1.6.0" Define the Pipeline
10. terraform.yml !!" # when to run this pipeline on: push: jobs: # all the stuff it needs to do happy_path: steps: - uses: "hashicorp/setup-terraform@v2.0.3" - run: terraform fmt -check -recursive !# terraform validate with: version: "1.6.0" Define the Pipeline
11. Ship it.
12. $ from the Security Team
13. terraform.yml My Pipeline Definition !!" # when to run this pipeline on: push: jobs: # all the stuff it needs to do happy_path: steps: - uses: "hashicorp/setup-terraform@v2.0.3" - run: terraform fmt -check -recursive !# terraform validate with: version: "1.6.0"
14. terraform.yml Their Pipeline Definition !!" # when to run this pipeline on: push: jobs: # all the stuff it needs to do happy_path: steps: - uses: "hashicorp/setup-terraform@633b725c73b2cacd13a8fdd1" - run: terraform fmt -check -recursive !# terraform validate with: version: "1.6.0"
16. Getting Release Information https://docs.github.com/en/rest/releases/releases
17. variables.tf variable "actions_config" { type = map(object({ owner = string repository = string version = string })) default = { # see https:!"github.com/hashicorp/setup-terraform/releases terraform = { owner = "hashicorp" repository = "setup-terraform" version = "v2.0.3" } } } Define a Set of Actions
18. variables.tf data "github_release" "actions" { for_each = { for id, action in var.actions_config : id !& action } repository = each.value.repository owner = each.value.owner retrieve_by = "tag" release_tag = each.value.version } data "github_ref" "actions" { for_each. = data.github_release.actions repository = each.value.repository owner = each.value.owner ref = "tags/${each.value.release_tag}" } Retrieve Release Information
19. variables.tf Transform Release Information locals { actions_config = { # This place is not a place of honor. # no highly esteemed deed is commemorated here. # (but we really needed these values) for action in tolist(keys(var.actions_config)) : action !& { owner = var.actions_config[action].owner path = var.actions_config[action].path ref = data.github_ref.actions[action].ref repo = var.actions_config[action].repository sha = data.github_ref.actions[action].sha version = var.actions_config[action].version } } }
20. Terminal Verify Transformed Data > terraform output github_actions_releases { "terraform" = { "repo" = "hashicorp/setup-terraform" "sha" = "633666f66e0061ca3b725c73b2ec20cd13a8fdd1" "version" = "v2.0.3" } }
21. terraform.tftpl.yml Prepare Template !!' jobs: workflow: name: Terraform runs-on: ubuntu-latest steps: # github.com/${owner}/${repo}/releases/tag/${version} - name: Set up Terraform uses: "${owner}/${repo}@${sha}" # ref: `${ref}` with: terraform_version: "1.6.0" !!'
22. variables.tf Render Template locals { repository_files = [ { file = ".github/workflows/terraform.yml" content = templatefile("./tmpl/terraform.tftpl.yml", { checkout = local.actions_config["checkout"] terraform = local.actions_config["terraform"] } ) }, ] }
23. terraform.yml Render Template !!' jobs: workflow: name: Terraform runs-on: ubuntu-latest steps: # github.com/hashicorp/setup-terraform/releases/tag/v2.0.3 - name: Set up Terraform uses: "hashicorp/setup-terraform@633!!'dd1" # ref: `tags/v2.0.3` with: terraform_version: "1.6.0" !!'
24. Add Rendered Template to Repository https://github.com/workloads/workspaces/blob/main/.github/workflows/terraform.yml
25. organization.tf Update Allow List for Actions resource "github_actions_organization_permissions" "main" { allowed_actions = "selected" enabled_repositories = "all" allowed_actions_config { github_owned_allowed = false verified_allowed = false } }
26. organization.tf Update Allow List for Actions resource "github_actions_organization_permissions" "main" { allowed_actions = "selected" enabled_repositories = "all" allowed_actions_config { github_owned_allowed = false verified_allowed = false patterns_allowed = [ for action in local.actions_config : action.path !( null ? "${action.owner}/$ {action.repository}/${action.path}@${action.sha}" : "$ {action.owner}/${action.repository}@${action.sha}" ] } }
27. Update Allow List for Actions https://github.com/workloads/workspaces/blob/main/.github/workflows/terraform.yml
28. Update Allow List for Actions https://github.com/workloads/workspaces/blob/main/.github/workflows/terraform.yml
29. Demo Code https://github.com/workloads/github-organization
30. What's next?
32. Software Security is a Team Sport.
33. Thank you speakerdeck.com/ksatirli