Cybersecurity / Terraform · GitHub Actions

Automated security pipelines

An AWS infrastructure example pairs Terraform with automated security checks. Compare an insecure fixture with the corrected configuration.

Terraform / security reviewRecorded local checks · No deployment

Pull request checks

Configuration before and after

Checkov reads the Terraform files. Switch versions to inspect the policy findings, then check the dependency gate below.

7failed selected resource checks

Deliberately insecure fixture

CKV2_AWS_6failed

Connected access block

The bucket's public-access block does not meet the required settings.

Resource: aws_s3_bucket.data
Input file: fixtures/insecure/main.tf
Scanner: Checkov 3.3.29

Read the Terraform input

# Deliberately incomplete configuration for scanner regression tests.
# This folder is never planned or applied by the workflow.
resource "aws_s3_bucket" "data" {
  bucket_prefix = "sr-insecure-fixture-"
}

resource "aws_s3_bucket_public_access_block" "data" {
  bucket                  = aws_s3_bucket.data.id
  block_public_acls       = false
  block_public_policy     = false
  ignore_public_acls      = false
  restrict_public_buckets = false
}

Terraform format · passedterraform fmt -check -recursive exited 0.

Terraform validate · unverifiedThe local runtime blocked the AWS provider Unix socket. The CI workflow retains this validation gate.

Selected S3 policies · passed18 resource checks passed. The access-log destination has one documented logging exception.

Tool dependency audit · blockedpip-audit flagged 2 resolved packages. The workflow leaves this gate blocking.

The dependency gate remains blocked

The recorded pip-audit output flagged asteval 1.0.6 and ecdsa 0.19.2. The GitHub Actions job keeps those findings blocking. Its result can change when dependencies or advisory data change.

Read the recorded audit

Terraform formatting and selected policy checks ran locally. Provider validation was blocked by the local runtime. GitHub Actions and AWS deployment have not been run.

Implementation notes

A corrected configuration still needs review

Terraform defines an AWS S3 bucket with public access blocked. A separate bucket receives its access logs. The GitHub Actions workflow runs checks before any cloud deployment.

Checkov compares the configuration against an explicit policy set. The insecure fixture keeps regression tests honest: a check that passes everything would fail this example.

The dependency audit is a separate gate in GitHub Actions. Fixing an S3 setting does not clear an advisory in the scanning toolchain. Review findings before enabling deployment.

GitHub Actions security guidance

Run locally

Source and example data

The Terraform project includes the example inputs and tests. Open its README for prerequisites and the complete workflow.

Download project source

python -m venv .venv
source .venv/bin/activate
python -m pip install -r requirements-tools.txt
python scripts/verify_fixtures.py

Read the setup notes

Back to the courtyard All work