Skip to main content

🔍 Audit Terraform Provider Inventory for Supply Chain Risks

info

To follow this guide you need a SafeDep Cloud API Key and Tenant Identifier. See Cloud Quickstart on how to onboard to SafeDep Cloud and get an API key.

In this guide, we will look at discovering Terraform providers used in a Terraform project. We will synchronize the inventory (BOM) with SafeDep Cloud and execute queries to discover unofficial providers that may pose a risk to the security of developer, cloud and CI/CD infrastructure.

Scan and Discover Terraform Providers​

info

vet must be installed to run this scan. See quickstart for vet installation options.

Run vet on your Terraform code base to scan for Terraform providers. The terraform project must be initialized i.e. .terraform.lock.hcl must be available in the project directory.

vet scan -D /path/to/terraform-code \
  --report-sync \
  --report-sync-project gh/test/infra1 \
  --report-sync-project-version main

Query by Terraform Provider Insights​

info

We will use SafeDel Cloud SQL queries to filter results. See SafeDep Cloud Quickstart for more details

Query for unofficial Terraform providers

vet cloud query execute --sql "
  select projects.name, projects.version, packages.name, packages.version 
    from projects 
      where terraform_providers.tier != 'official'
"

Example response generated from our test repository

┌───────────────────────────────────────────┬──────────────────┬────────────────┬──────────────────┐
│ PACKAGES.NAME                             │ PACKAGES.VERSION │ PROJECTS.NAME  │ PROJECTS.VERSION │
├───────────────────────────────────────────┼──────────────────┼────────────────┼──────────────────┤
│ registry.terraform.io/hetznercloud/hcloud │ 1.48.0           │ gh/test/infra1 │ main             │
├───────────────────────────────────────────┼──────────────────┼────────────────┼──────────────────┤
│ registry.terraform.io/hetznercloud/hcloud │ 1.48.0           │ gh/test/infra1 │ main             │
├───────────────────────────────────────────┼──────────────────┼────────────────┼──────────────────┤
│ registry.terraform.io/hetznercloud/hcloud │ 1.48.0           │ gh/test/infra1 │ main             │
└───────────────────────────────────────────┴──────────────────┴────────────────┴──────────────────┘%

List the query schema to see all queryable and filterable columns for Terraform providers

vet cloud query schema

Reference​