November 2024 Summaries

HashiCorp Terraform 1.10 is now generally available with ephemeral values for secure secrets handling, improved plan and apply performances, and new functions. Ephemeral values are not stored in any artifact, ensuring that sensitive data such as credentials or tokens are not persisted in the plan or state file. This feature enhances Terraform's ability to manage infrastructure by providing a more secure workflow for handling secrets. The release also includes performance improvements and support for ephemeral resources in AWS, Azure, Kubernetes, and Google Cloud providers.

The article discusses the challenges faced by development (Dev) and security (Sec) teams due to their contrasting priorities and expectations. It highlights that while Sec teams focus on data protection and preventing breaches, Dev teams prioritize speed, innovation, meeting marketplace demands, and improving user experience. This often leads to conflicts resulting in software vulnerabilities, slowed development, misaligned toolchains, and corrosive cross-team communication. The article suggests the implementation of a consolidated internal development platform (IDP) as a solution to bridge this gap through tooling and automation. It emphasizes the need for a platform team to standardize tooling platforms and workflows across an organization, integrating security best practices into developer workflows. The article also mentions HashiCorp's Infrastructure Cloud as a consolidated solution that can help reduce Dev and Sec team stress, improve efficiency, and implement security best practices at all layers of cloud software development by building an end-to-end cloud IDP.

Infrastructure Lifecycle Management (ILM) best practices can help businesses improve DevEx, speed up software delivery, and enhance security. Automating infrastructure provisioning with Infrastructure as Code (IaC) allows for codification, standardization, replication, reuse, storage, centralization, auditing, and versioning of infrastructure. This accelerates development and deployment processes while ensuring compliance and security standards are met. Building and reusing golden configurations helps maintain consistency across an organization's cloud environment, reducing the risk of snowflake servers and potential security vulnerabilities. Leveraging policy as code enables organizations to create, review, and version control automated provisioning checks in a single language that stakeholders can understand, audit, and contribute to. Enabling self-service infrastructure allows developers to work autonomously without compromising on compliance or security standards. Finally, automating infrastructure deletion helps avoid wastage of cloud resources by setting end-of-life dates or predefined inactivity periods for removal.

HashiCorp has released an upgrade to its HCP Vault Dedicated offering, version 1.18, which includes several new features such as expanding disaster recovery (DR) region coverage, syncing secrets across providers, and adding PKI EST among other key features. The update also introduces secret sync capabilities, enhanced UI permissions on subkeys, cross-region DR capabilities, and support for PKI EST protocol. These enhancements aim to improve Vault resilience, reduce risks, and increase operator and user efficiency.

HashiTalks, a global virtual event for knowledge sharing, will take place on February 20, 2025. The call for proposals is open until December 1, 2024. This annual HashiCorp User Group (HUG) event features experts from the community who share their experiences using HashiCorp tools to manage infrastructure, secure data, and deploy applications both on-premises and in the cloud. The event will be held in English with ASL support and is open to first-time speakers. Talks given at HashiTalks will be recorded and posted on YouTube for on-demand viewing. Registration is encouraged but not required, and attendees can join local HUG chapters or watch the talks on YouTube after the event.

The prolonged tension between developers and security teams can undermine the efficacy of cloud security, with both sides having different priorities and using mismatched tools. To resolve this conflict, platform-led workflows that make cloud security seamless and scalable are recommended. This involves shifting further left by establishing a secure, golden developer path, reducing friction between teams, and satisfying their objectives. The shift-left movement emphasizes the importance of testing and other aspects of security and QA review in the early and middle stages of development rather than just at the end. By leveraging APIs, automated checks, self-service tooling, and guardrails like secure modules and policy as code, organizations can avoid bottlenecks created by development teams submitting changes for manual review by security or compliance teams. The right tools and platforms are crucial in improving collaboration between dev and sec teams, with a focus on Infrastructure Lifecycle Management (ILM) and Security Lifecycle Management (SLM). HashiCorp's Infrastructure Cloud, which includes Terraform and Vault, is one such solution that supports secure provisioning and centralized secrets management.

HashiCorp is returning to AfroTech as a sponsor, offering various reasons to visit their booth at #1107. These include gaining industry knowledge and insights, winning certifications, meeting recruitment teams, learning about inclusive culture, and building networks. The company will also be raffling off prizes like Apple AirPods and other tech essentials.

HashiCorp is set to make a significant presence at AWS re:Invent, the largest cloud conference hosted by Amazon Web Services (AWS). The event will take place from December 2nd to December 6th in Las Vegas. During the conference, attendees can learn about HashiCorp's unified approach to Infrastructure and Security Lifecycle Management through breakout sessions, expert talks, and product demos. HashiCorp is an Emerald sponsor of re:Invent 2024 and has a full program of events lined up for both in-person and remote attendees. Key highlights include visiting the HashiCorp booth (1112) for product demos, technical deep dives, limited-edition swag collection, integration highlights, and community zone discussions on Infrastructure and Security Lifecycle Management. Additionally, HashiCorp will be presenting four breakout sessions at re:Invent, covering topics such as building scalable and secure cloud infrastructure with the HashiCorp Cloud Platform (HCP), managing complex application platforms with Terraform, secrets management in a service-oriented architecture, and infrastructure for AI and ML workloads on AWS. Furthermore, attendees can catch 15-minute tech talks every hour at the booth theater, joint sessions with AWS, and notable sessions featuring Terraform in the AWS session catalog. HashiCorp will also host a breakfast event for its certified product users, ambassadors, contributors, and collaborators on December 5th at CHICA Las Vegas. To learn more about HashiCorp's presence at re:Invent or to book a meeting with the company during the conference, visit https://events.hashicorp.com/awsreinvent2024.

HashiCorp has introduced a new feature that automatically cancels plan-only Terraform runs triggered by pull requests in version control systems (VCS) for HCP Terraform and Terraform Enterprise. This enhancement helps customers avoid the backlog of multiple runs caused by new commits pushed to a branch, ultimately speeding up the application delivery process. The automatic cancellation of plan-only runs can now easily cancel any unfinished runs for outdated commits by selecting the option in an organization's settings.

HashiCorp Boundary is a solution that secures remote access to private HTTPS targets with transparent sessions, acting as a true VPN replacement. It leverages Identity Providers (IdP) to enable granular control over user access to resources within an organization's network. The new feature of transparent sessions greatly simplifies the workflow by enabling Boundary to shift from active to passive connection processes. This allows users to connect securely while imposing granular control about what individual users and/or groups can connect to, without relinquishing any capabilities of Boundary.