January 2025 Summaries

The three workflows for managing Terraform runs in HCP Terraform are UI/VCS, CLI, and API-driven. The UI/VCS workflow is the simplest and most push-button method, ideal for organizations seeking simple traceability and transparency, GitOps workflows, or easy setup of collaborative provisioning workflows. In contrast, the CLI-driven workflow offers more flexibility but requires a steeper learning curve, suitable for developers comfortable with Terraform's CLI tools and those who want to integrate it into existing CI/CD pipelines. The API-driven workflow is the most flexible but also has the highest learning curve, necessary for custom workflows integrated with specific toolchains or requiring granular controls for each step of the workflow. Each workflow has its unique setup, maintenance, and security considerations, making it essential to evaluate which one suits the organization's needs and skill levels.

HCP Terraform provides a way to securely access Azure using OpenID Connect (OIDC) federation, eliminating the need for long-lived credentials. This allows users to authenticate with Azure as a service principal through a native OIDC integration, obtaining temporary credentials at runtime and discarding them when the run completes. The process involves setting up a trust relationship between HCP Terraform and Azure, configuring Azure platform access, and configuring resources on HCP Terraform to use dynamic credentials. This enables users to securely scale access management within HCP Terraform by delegating access from one workspace to another while precisely restricting Azure access to only what the service principal needs. The solution can be scaled by creating an HCP Terraform variable set for each workspace, configuring environment variables, and sharing the variable set with the targeted workspace. This allows HCP Terraform to automatically obtain and inject temporary credentials, enabling users to securely access Azure without managing long-lived credentials.

The text discusses the challenges of managing infrastructure state files in Terraform Community Edition, particularly as teams grow and collaboration becomes more complex. It highlights the benefits of migrating to HCP Terraform and Terraform Enterprise, including centralized state management, improved governance, and seamless collaboration. The authors introduce Terraform migrate (tf-migrate), a command-line tool that automates state migrations to HCP Terraform and Terraform Enterprise, simplifying workspace setup and supporting modular refactoring. tf-migrate mitigates the risks of human error and misconfigurations during state file safety, saving weeks' worth of planning and operational effort. The authors outline the use cases and current capabilities of tf-migrate, including migration and state refactoring, as well as a basic setup and workflow for performing a migration with tf-migrate. They also discuss potential future features of tf-migrate, such as integrating popular version control systems and enhancing security and compliance. Ultimately, Terraform migrate bridges the gap between Terraform Community Edition and commercial editions, making it simple and straightforward to adopt a commercial edition while minimizing risks associated with state file migrations.

HCP Packer has released a new feature called SBOM storage, which provides visibility into the components of image artifacts and improves supply chain security. This feature helps platform teams identify vulnerabilities earlier in the deployment process, track outdated libraries, and ensure images meet compliance requirements. With SBOM storage, users can generate and securely store software bills of materials (SBOMs) for Packer-built artifacts directly in the HCP Packer artifact registry, providing a centralized location to view details on the components of all their artifacts across cloud and on-prem environments. This feature is now available in public beta and is compatible with various SBOM generation provisioners, allowing users to continue using their preferred tools while benefiting from HCP Packer's SBOM storage and compliance capabilities.

Platform engineering is a humanistic approach that aims to reduce human error-driven vulnerabilities in cloud estates. By designing and building tools and workflows, platform engineers can create a cohesive, secure, and efficient enterprise cloud operating model. This approach is critical for organizations with siloed cultures, where development and operations teams often work at cross-purposes. An internal developer platform (IDP) is a key component of this approach, providing security, development, and operations components in a single, scalable framework. By implementing an IDP, organizations can reduce human error and risk, improve software developer productivity, and create a single point of engagement for cybersecurity, software development, IT operations teams, and compliance. The platform engineer's role is to shift left, putting testing, vulnerability scans, and best practice templating in the earlier stages of software development, and to implement a security plane into every developer workflow. This approach can mitigate risk and improve efficiency by driving consistency, streamlining developer workflows, scaling compliance and security practices at scale through automation, and providing strong protection that is invisible to users.

The majority of cybersecurity attacks in 2025 will focus on exploiting easily accessible vulnerabilities, such as exposed credentials and user access patterns. The NIST framework's 2.0 update from 2024 aligns with the vision for Security Lifecycle Management (SLM), which involves protecting secrets, identifying access, detecting breaches, and securing modern infrastructure access systems. Hard-coded credentials in AI services are a common vulnerability, and using tools like HashiCorp Vault can help manage and rotate these secrets. The dangers of access tooling sprawl and exposed plaintext credentials when cloning repositories also need to be addressed, with the use of secret scanners like HCP Vault Radar providing critical detection capabilities. Ultimately, making security best practices easy to follow, facilitating collaboration between departments, and providing visibility into system access are key takeaways from 2024 breaches.

Fannie Mae is accelerating its operations with IT infrastructure lifecycle management products like Terraform Enterprise, automating large-scale cloud infrastructure provisioning while mitigating security and compliance risks through policy as code supported by Terraform's Sentinel framework. The company has implemented a comprehensive process for developing Sentinel policies, consisting of five stages: requirements, development, testing, review, and release. This process includes fine-tuning requirements gathering, thinking about performance, reusing code, considering backward compatibility, and adopting a multi-year journey to adopt policy as code in Terraform Enterprise. Fannie Mae has pointed out key areas for other adopters to focus on, including fine-tuning requirements, thinking about performance, reusing code, and considering backward compatibility.