Is terraform a suitable tool for creating and managing cloud IAM resources? The short answer is – no. Especially, if you are going to be dealing with a large number of such creation requests.

Time taken to apply terraform for IAM

Check whether the IAM resource already exists – across all buckets that store state. This could take hours. Can you afford to wait for hours for a simple identity creation or a role assignment?

State drift – Console based roles and assignments

Certain IAM actions performed via the console will cause state drift. The next run of your IAM script will not pick these up – and essentially wipe them out.

Of course, if you have IAM creation etc. locked out for console users, you will not face this particular issue.

Summary

For smaller scoped IAM requests – say you have a dozen or so requests to deal with – terraform for IAM may be a workable solution.

The post Terraform for IAM resource creation appeared first on For all your terraform needs.

The installed provider plugins are not consistent with the packages selected in the dependency lock file:
│ – registry.terraform.io/hashicorp/azurerm: the cached package for registry.terraform.io/hashicorp/azurerm x.y.x. (in .terraform\providers) does not match any of the checksums recorded in the dependency lock file
│ – registry.terraform.io/hashicorp/random: there is no package for registry.terraform.io/hashicorp/random 3.4.3 cached in .terraform\providers

Resolution

Step 1 – Look for this lock file (terraform.lock.hcl) in your current module. Delete it.

Step 2 – Re Run terraform init -upgrade

The post Error – ‘registry.terraform.io/hashicorp/local: there is no package for registry.terraform.io/hashicorp/local cached in .terraform/providers’ appeared first on For all your terraform needs.

terraform-google-gcloud

This module allows you to use gcloud, gsutil, any gcloud component in Terraform.

This module does not create any resources on GCP itself, rather exposes the GCP SDK to you for usage in null resources & external data resources.

What about accomplishing the same thing on azure?

provider "azurerm" {   features {  } } 
resource "azurerm_resource_group" "rg" 
{   name     = "TFRDemo"   
    location = ""   
    provisioner "local-exec" 
     {     
       command = "az account show --output table" 
     } 
}

The post What if there is no Terraform Support for certain GCP Features? appeared first on For all your terraform needs.

If locking of the state file is not natively supported, you must ensure that you do a terraform state pull each time, before renewing your work. (Also See Managing Terraform State )

Summary

Check hashicorp’s  documentation to determine whether a backend supports locking or not. E.g. S3 doesn’t support locking by default, but with a little effort, you can make S3’s remote state locking capable.

The post More on Remote State and State Files appeared first on For all your terraform needs.

The post Terraform SaaS versus Terraform Enterprise (TFE) appeared first on For all your terraform needs.

The TWO most commonly implemented ones would be the managed infrastructure services pipeline (or just infra pipeline) and the app pipeline.

A Foundational Pipeline would include setting up the original organization and folder structure in GCP.

Need an experienced Data Protection Expert?  Anuj has successfully delivered over a dozen deployments on each of the public clouds (AWS/GCP/Azure) including several DevSecOps engagements. Set up a time with Anuj Varma.

The post How many Pipelines? appeared first on For all your terraform needs.

Instance Protection – Protection of a running instance

   GCP Shielded VMs – Vulnerability Management built in

Image Protection – Protection of images before they become instances (golden images)

Qualys SaaS Portal

•    Dashboard displaying violations
•    No Remediation Possible

Prisma SaaS

•   Remediation of certain violations Possible

Rapid 7

Prisma SaaS versus Qualys

Work in progress

Need an experienced AWS/GCP/Azure/DevSecOps Professional to help out with your Public Cloud Strategy? Set up a time with Anuj Varma.
 

The post Deep Monitoring – Vulnerability Management on GCP VMs appeared first on For all your terraform needs.