Terraform security scanning tools - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Identify the primary purpose of Terraform security scanning tools

What is the main goal of using security scanning tools with Terraform configurations?

A To optimize the cost of cloud resources after deployment

B To automatically deploy infrastructure without manual approval

C To detect potential security risks and misconfigurations before deployment

D To monitor real-time network traffic of deployed resources

💡 Hint

Think about what security scanning tools check in code before it runs.

Terraform security scanning tools analyze the code to find security issues or risky settings before the infrastructure is created. This helps prevent vulnerabilities early.

❓ service_behavior

intermediate

Behavior of Terraform Sentinel policy when a security rule fails

In Terraform Cloud, if a Sentinel policy designed to block insecure resource configurations fails during a plan, what happens?

A The Terraform plan is blocked and cannot be applied until the issue is fixed

B The Terraform plan is applied but logs a warning message

C The Terraform plan ignores the Sentinel policy and proceeds normally

D The Terraform plan automatically fixes the insecure configuration

💡 Hint

Sentinel policies enforce rules before changes happen.

Sentinel policies act as gatekeepers. If a policy fails, Terraform Cloud blocks the plan from applying to prevent insecure changes.

❓ Configuration

advanced

Detecting insecure AWS S3 bucket configuration with tfsec

Given the following Terraform snippet, which tfsec command output correctly identifies a public S3 bucket risk?

Terraform

resource "aws_s3_bucket" "example" {
  bucket = "my-public-bucket"
  acl    = "public-read"
}

A INFO: aws-s3-bucket-versioning: Bucket 'my-public-bucket' does not have versioning enabled

B ERROR: aws-s3-enable-bucket-encryption: Bucket 'my-public-bucket' does not have encryption enabled

C WARNING: aws-s3-enable-bucket-encryption: Bucket 'my-public-bucket' has public read ACL, which is insecure

D WARNING: aws-s3-public-read-prohibited: Bucket 'my-public-bucket' has public read ACL, which is insecure

💡 Hint

Look for the tfsec rule that warns about public read ACLs.

tfsec warns with 'aws-s3-public-read-prohibited' when a bucket has a public read ACL, indicating a security risk.

❓ Architecture

advanced

Best architecture to integrate Terraform security scanning in CI/CD

Which architecture best integrates Terraform security scanning tools into a CI/CD pipeline to ensure security checks before deployment?

A Include security scanning as a step after deployment to production

B Add security scanning as a mandatory step after Terraform plan and before apply in the CI/CD pipeline

C Run security scanning tools only on completed Terraform apply in production

D Run security scanning tools as a pre-commit hook on developer machines only

💡 Hint

Think about when security checks should block unsafe changes.

Integrating security scanning after plan and before apply in CI/CD ensures unsafe configurations are caught before deployment.

❓ security

expert

Identifying the cause of a Terraform security scan failure with Checkov

Given this Terraform resource snippet, which Checkov rule failure explains why the scan fails?

resource "aws_security_group" "example" {
  name        = "allow_ssh"
  description = "Allow SSH inbound"

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

A CKV_AWS_21: Security group allows ingress from 0.0.0.0/0 on port 22 (SSH) which is insecure

B CKV_AWS_52: Security group missing egress rules, blocking all outbound traffic

C CKV_AWS_70: Security group has no tags defined for resource tracking

D CKV_AWS_99: Security group uses deprecated protocol type

💡 Hint

Which rule warns about open SSH access from anywhere?

Checkov rule CKV_AWS_21 flags security groups that allow SSH access from all IPs (0.0.0.0/0) as a security risk.