Ned Bellavance’s Post

View profile for Ned Bellavance, graphic

Technical Educator and Content Creator | Microsoft MVP 8x | HashiCorp Ambassador 5x

TerraHash - a way to lock and verify modules in Terraform by hash. This is the Go project I alluded to earlier in the week. This is still very much a WIP. I haven't even created a build pipeline to generate binaries. Here's the problem I'm trying to address: Modules used by Terraform are not locked in any way or verified by a hash. My recommendation is to set the version constraint for a module to a specific version (e.g. version = "1.2.3") and not a range. Even if you do that, the module maintainer could (in theory) recreate the release with the same version number and different code. It's a possible attack vector or simply has the potential to break things. The solution could be similar to what the .terraform.lock.hcl file does for providers. Create a module lock file that has a hash of each module's contents and verify the hash after initialization. That's what TerraHash is meant to do. You can run it after Terraform initializes using the `terrahash init` command and it will create a lock file called .terraform.module.hcl. The `terrahash check` command verifies the module hashes against the lock file and exits with a 1 code if they don't match. The `terrahash upgrade` command updates the lock file to the current modules. There's still a lot of testing and features I need to get to. But let me know what you think! https://lnkd.in/egBDWYhs

GitHub - ned1313/terrahash: Create and store a hash of the Terraform modules used by your configuration

GitHub - ned1313/terrahash: Create and store a hash of the Terraform modules used by your configuration

github.com

Ned Bellavance

Technical Educator and Content Creator | Microsoft MVP 8x | HashiCorp Ambassador 5x

6mo

Finished adding a CI and build pipeline, but still need to add tests and some additional features. You can grab the binary now and take it for a spin. I'm also ready for people to submit issues, but not quite ready to accept contributions. This is my first real Go project and I'm going to be selfish with it for a while longer.

🏳️🌈🏳️🌈 Kyler Middleton

Cloud Security Chick | LetsDoDevOps.com | Microsoft MVP (DevOps) | AWS Community Builder x2 (Containers) | Day Two DevOps Podcast Host | Former Hashi Ambassador | Open Source Zealot

6mo

This is a great idea!

John W.

Center of Excellence and Solution Area Lead for Microsoft Azure and GitHub at Cognizant

6mo

Love this idea!

See more comments

To view or add a comment, sign in

Explore topics