Enabling Developers with Terraform

An introduction to Terraform, Sentinel, Vault and Hashicorp Enterprise products.

Not sponsored by HashiCorp, I don't work there, just work with their products.

Transcript

1. Enabling Developers with Terraform Email: iamacybercop@gmail.com @devi.calligraphy on Instagram @theulzo on twitter
2. Hello World! Devina Dhawan (they-vee-nah) (thaa-vun) She/Her Senior Information Security Engineer @ Hulu Cat & Rabbit Mama Calligrapher
3. Context... Security @ Etsy - Open Source Terraform/Open Source Vault Security @ Hulu - Terraform Enterprise/Vault Enterprise
4. Vault Deployment Vault Prod Vault Prod DR Vault Prod PR Vault Non-Prod Vault Non-Prod DR Vault Non-Prod PR Vault Sandbox
5. Vault Deployment Vault Prod Vault Node Vault Node Vault Node Consul Node Consul Node Consul Node Consul Node Consul Node =
6. What is this talk? <3 AWS Meetup & HashiCorp Meetup Beginner Level Architecture Gotcha’s
7. What is this talk not? ADVANCED Strict
8. What will we discuss today? • What is Terraform? • What is the difference between Terraform & AWS UI • How to program in Terraform ◦ Resources ◦ Modules ◦ ... • Options
9. What is Terraform?
10. Terraform - Terraform is both a programming language & its a tool for actioning that code. - Terraform is a tool for building, or changing, or versioning your infrastructure (servers, storage buckets, databases)
11. Terraform Server provisioning Container deployment - Docker/Packer/Kubernetes Cloud / On-Prem
12. Why is Terraform Useful?
13. AWS User Interface…
14. Benefits Cloud agnostic Auditable Orchestration capabilities
15. Benefits - Cloud Agnostic - Picking one Cloud Provider doesn’t dig you into a deep dark hole - Resource types aren’t the same but - the how resources are created is the same
16. Benefits - Auditability - Security/Compliance - Who made what changes in your infrastructure? - Who approved those changes to be made?
17. Benefits - Orchestration - Manages merge collisions - Terraform state locking - Testing
18. UI vs Terraform
23. Manual Configuration after Launching - SSH Keys for Developers - Packages - Software
24. Once more with Terraform main.tf
25. Init
26. Init
27. Init
28. Make an instance -> Configure that instance
29. TF State
30. TF State - Record of changes - Output data - Making changes outside of terraform
31. Secrets in TF State Gotcha - Outputing IAM Keys in TF State will mean that your secrets are in TF State for everyone to read - PGP Encrypt
32. Secrets in TF State
33. Drift Gotcha - Creating new things in UI and trying to reference them in Terraform - Changing terraform’d infrastructure in the UI.
34. Using S3 - Coordinate with your team without overwriting your state files - Backend becomes s3 - State file locks to prevent collision
35. Workspaces
36. What is a workspace? - Directory where your main.tf lives - Terraform configurations - Variable Values - State - Credentials & Secrets
37. Workspaces - Backup State files - Run history - Terraform apply - Logs - Terraform Enterprise
38. Let’s Write some Code - Workspaces - Resources - Providers - Modules - Output Statements - Sentinel
39. Resources Type Local Name
40. IAM Role Example
41. IAM Role Example
42. IAM Role Example
43. Providers main.tf
44. Cloud System Services
45. - TFE Internal Vault - External Vault - Local credential file Services Gotcha
46. Vault
47. Modules
48. Modules - Think Classes/Objects in any OOO language - Parent module -> child module - Version controlled
49. Modules in TFE
50. Modules in TFE module.consul.ami_id
51. Output in Modules
52. Fun Ideas with Modules - Auto generate module based infrastructure using scripts - Great for Documentation - Use Versioning for different versions of api’s
53. - Keep track of versions - Announce deprications Versioning Gotcha
54. Sentinel - Policy as Code - Define policies to parse TF Plan, State & Config - Runs after TF Plan
57. What did we learn? - Workspaces - Resources - Providers - Modules - Output Statements - Sentinel
58. Choices… Choices… Choices… Choices… Choices… Choices… Choices… Choices…
59. Terraform Options Open Source Terraform / Enterprise Monolith Repo / Some Repos / Many Repos Secrets Management Permission to execute terraform
60. Open Source Enterprise - Fo Free - Great for small teams - Experimentation - Local development - $$$ - Larger companies - Migrations - Sentinel requirements - Secrets Management
61. One Repo Some Repos Many Repos - Everything has a place, you know exactly where to go when you need to look something up - Workspaces are folders in project - Collisions in tfstate highly likely - Everything is organized by team/group/dom ain - Slightly harder for engineers to know where to go - Collisions in tfstate moderately likely - Entirely dependant on whomever wants to create a repo/workspace/etc. - Documentation highly necessary! - Collisions are least likely
62. External Vault Internal Vault - Difficult to set up - Manage all your secrets - Lots of work up front for a bigger payout - Can use this - So So So Easy - Available in TFE - Secrets available in TFState
63. External Vault Internal Vault - Difficult to set up - Manage all your secrets - Lots of work up front for a bigger payout - Can use this - So So So Easy - Available in TFE - Secrets available in TFState Gotcha
64. Admin Execute Terraform Only - Give Admin executer privileges - Developers can write infrastructure code - Admin can approve/deny - Admin can Execute Lots of overhead for Admin - Anyone can write terraform code - Admin can approve/deny code - Developers can use an orchestrator (in house/jenkins) to execute code - No developers are given access to do anything in the UI
65. RECAP - Vault - Terraform vs UI - Terraform Programming Language - Sentinel Policy Language - Choices that are yours to make - Gotcha’s
66. Shameless Plug #1 Girls Who Code - Ages 12-18 - University of Illinois at Chicago - Saturday mornings from 10am - 12pm - Women & Non-Binary engineers wanted! esoto3@uic.edu
67. Shameless Plug #2 Wanna learn Calligraphy? @devi.calligraphy
68. Thank you!
69. Q/A Email: iamacybercop@gmail.com Instagram: @devi.calligraphy Twitter: @theulzo