Solution Brief

Building Secure Applications
with HashiCorp Terraform andPosture Control by Zscaler© 2024 Zscaler, Inc. All rights reserved.

Business Challenge
Organizations around the world have made a

HashiCorp Terraform plays a pivotal role in themonumental shift towards providing customers

rapid development and deployment of new

with an intuitive and sophisticated digitalapplications, but organizations are still struggling

experience. They’re now catering to every phaseto assess and respond to various risks to theirof consumer behavior, ranging from advertisinginfrastructure. New threats and risks arising fromand buying to after-sales support. The

misconfigurations in CI/CD pipelines, combined

magnitude and scale of this digital transformation

with the speed at which automation can multiply

are made possible by shifting their infrastructure

these issues, lead to exposure of attack surface

from conventional data centers to state-of-the-and rapid risk proliferation. Cloud infrastructure

art infrastructure management from public

development and management are opaque to thecloud vendors.

security team. This makes operations prone toDevOps teams are at the forefront of thistransformation, leading the way with the rapid
deployment of code and building infrastructure

misconfigurations introduced due to the skippingof established guardrails and the drift away fromthe intended state of the infrastructure.

with modern CI/CD pipelines across multiple

An application can be made both continuously

public cloud environments. Teams are often

secure and reliable with closer collaboration

challenged with managing skill gaps widened due

between the DevOps and Security teams, ato complex multi-cloud environments that canpractice that would reinforce security at every

slow down the pace of development. DevOps

stage of the development pipeline. Transparent

communities have simplified their routine tasks

security promotes expedited application

by widely adopting HashiCorp Terraform, andeployment and makes the DevOps team an

infrastructure-as-a-code (IaC) tool to provision,equal stakeholder in producing highly resilient andchange, and version resources onsecure applications.

any environment.

DevOps and Security Challenges• Complex multi-cloud infrastructure with non-portable scripting• Committed change impact not visible until deployed in production• At loggerheads with the security team perpetually due to lack of visibility• Resource strain and skill gaps leading to misconfigurations© 2024 Zscaler, Inc. All rights reserved.

Solution Brief2

Solution
Posture Control + HashiCorp
Securing the CI/CD pipeline for an enriched
DevOps experience

Posture Control integration for Terraform Cloud
enables development teams to scan Terraformfiles — which are previews of potential
infrastructure changes — and compare thePosture Control™by Zscaler and HashiCorp

output against best practice security policies forTerraform integration provides a comprehensive

all major public cloud providers and Kubernetes.

solution that enables DevOps and Security

Policy violations in the Terraform pipelines can beteams to secure infrastructure-as-code (IaC).

prevented before the apply stage with Posture

The solution prevents misconfigurations, code

Control run tasks integration with Terraformleaks, environmental drift, and other cloud

Cloud. This helps to prevent out-of-compliancesecurity issues, all in a single integrated platform.

infrastructure from being provisioned andEach commit and pull request is scanned forprovides fast feedback on the issue, impact andchanges that may lead to issues related to hard-suggests a fix to development teams about

coded secrets, access changes that may cause

policy compliance.

misconfigurations, storage that is shared widely

Posture Control: Key Capabilities

beyond the scope of the content, and more.
Near-to-real-time alerts and guided remediation

Scans IaC configurations for errors

is critical for expedited and informed remediation.

When IaC configurations contain

The integration lays the foundation for a

misconfigurations and vulnerabilities, it is often

continuous security process that helps to detectdue to well-intentioned developers that havepotential IaC security vulnerabilities early in thepoor awareness of enterprise security policies. A

development cycle and fix them before they go

developer may open a port or change the visibility

into production. This helps to improve the overallof the content storage directory to enable arisk posture and maintain cloud compliance.

testing scenario and propagate the change toBenefits of Hashicorp Terraform and PostureControl integration• Detect, track and fix misconfigurations

the production environment. By integrating
checks into the DevOps workflows, and regularly
monitoring HashiCorp Terraform configurations
and scanning Terraform cloud workspaces

in Terraform configurations earlier infor misconfigurations, insecure default

CI/CD pipelines

configurations, publicly accessible cloud storage,• Resolve vulnerabilities and mitigate risk

or unencrypted databases with Posture Control,

to enhance security and compliance of

the DevOps team can now identify and remediate

deployment

potential violations before they are deployed in• Prioritize, contextualize and remediate cloud

the production environments.

infrastructure risks© 2024 Zscaler, Inc. All rights reserved.

Solution Brief

3

Enforces guardrails to counter drift

Secures hard-coded credentials

Terraform configurations ensure that theSensitive data such as secret keys, private keys,

cloud infrastructure is deployed in a uniform

SSH keys, access/secret keys, and API keys are

and consistent way across the multi-cloud

often found hardcoded in IaC configurations. The

environment in various stages of production.

exposed credentials can propagate rapidly with

However, sometimes application owners need

the IaC code committed to public repositories

to make modifications to their applications

and can pose a great risk for the organizations.

in a method that does not conform to theHashiCorp Terraform configurations are alsoestablished practices. Such changes are often

susceptible to this type of DevOps user error.

a response to urgent production situations or a

The best approach to prevent such hard-codeduser inadvertently making changes directly to thesecrets from leaking into the version control

infrastructure. The observed phenomenon of asystem is by scanning commits with Posture

gap between the desired and the intended state

Control before they are merged into the mainof the production configuration is known as drift.

branch and by highlighting the violations forIf left unchecked, it leads to an infrastructure

appropriate remediation.

exposed to attacks and renders the infrastructureout of compliance. With Posture Control,organizations benefit from the convergence of
IaC scanning and CSPM to help identify andremediate drifts as they are observed in all thestages of the CI/CD pipeline.
Enhances team collaboration
DevOps and Security teams often are noton the same page with security. Frequently,
the cause is a lack of visibility in each other’sdomain. The DevOps team is focused on rapid
and agile development powered by HashiCorp
Terraform automation, while the security teamis concerned with the threats and risks to theapplication and services infrastructure arisingfrom the misconfigurations and vulnerabilities
in the system. Posture Control breaks the silos

Posture Control andHashiCorp
Callout Terraformbox style,integrationconsectetur
providesa comprehensive
adipiscing elit.
solution
Maecenasthat pretium
enables
DevOps andtellusSecurity
est, atcongueteamsexto blandit
secureinfrastructure-as-code
iaculis tincidunt.
(IaC).

between these teams with a continuous unified
assessment and analysis of the risks and threats
to the application environment.

© 2024 Zscaler, Inc. All rights reserved.

Solution Brief

4

Posture Control Workflow
Application Teams

Infrastructure Code

Version Control

Build

Deployment

POLICY &GOVERNANCE

Terraform IaC Code files

Terraform Cloud

Scan terraform templates inall phases of the softwaredevelopment process

Scan workspaces
by integrating withTerraform Cloud
Run Tasks

Cloud InfrastructureContinuous
scanner for cloudinfrastructure

Posture Control

Fig: Posture Control IaC scan dashboard© 2024 Zscaler, Inc. All rights reserved.

Solution Brief5

About Posture Control
Posture Control, a cloud-native application protection platform (CNAPP), reimagines cloud-native
application security as a 100% agentless solution that uses machine learning to correlate hidden risks
caused by misconfigurations, threats, and vulnerabilities across the entire cloud stack. It empowers
security, development, and DevOps teams to efficiently prioritize and remediate risks in cloud-native andVM-based applications as early as possible in the development cycle.
Posture Control helps organizations proactively secure IaC with an integrated, cloud-native platform thatembeds security best practices in developer environments, integration tools, and source code repositories.
Using predefined policies to identify and prioritize high-risk misconfigurations, code leaks, environmental
drift, and more, organizations can keep continuous IaC governance under control with ease. PostureControl also provides rich context and guided remediation directly in popular DevOps tools and workflows,
including integrated development environments (IDEs), continuous integration (CI) tools, and version
control systems (VCS). Posture Control improves overall cloud security posture while reducing the burden
on security and operations teams as well as mitigating cross-team friction.
Posture Control is part of Zscaler for Workloads, a comprehensive cloud security solution for any
application running on any service in any cloud.

What to buy?
Posture Control Advanced version that includes Infrastructure as Code scanning.
Visit Posture Control for more information or contact us to get started with a free assessment of thesecurity of your DevOps pipeline.

About Zscaler
Zscaler (NASDAQ: ZS) accelerates digital transformation so that customers can be more agile, efficient, resilient,and secure. The Zscaler Zero Trust Exchange protects thousands of customers from cyberattacks and data loss
by securely connecting users, devices, and applications in any location. Distributed across more than 150 data
centers globally, the SASE-based Zero Trust Exchange is the world’s largest inline cloud security platform.
Learn more at zscaler.com or follow us on Twitter @zscaler.
+1 408.533.0288

Zscaler, Inc. (HQ) • 120 Holger Way • San Jose, CA 95134© 2024 Zscaler, Inc. All rights reserved. Zscaler™,
Zero Trust Exchange™, Zscaler Internet Access™,ZIA™, Zscaler Private Access™, ZPA™ andother trademarks listed at zscaler.com/legal/
trademarks are either (i) registered trademarks orservice marks or (ii) trademarks or service marksof Zscaler, Inc. in the United States and/or othercountries. Any other trademarks are the propertiesof their respective owners.

zscaler.com