The Business Value of Infrastructure as Code
As DevOps grows, it helps to know how it works. One of the big things in DevOps is “infrastructure as code” aka IaC. This means that you treat your infrastructure the exact same as you would treat your application code. So you’ll check it into version control, write tests for it, and make sure that it doesn’t diverge from what you have across multiple environments. Infrastructure deployments with IaC are repeatable and prevent runtime issues caused by configuration drift or missing dependencies. However, human error, particularly as long as manual processes are still around, cannot be removed. But it’s still possible to avoid critical issues upon deployment and prevent security leaks of sensitive data inside of IaC.
In DevoVision we always recommend to our customers prepare CI to build for IaC, regardless of technology stack usage in the project. The classic CI process looks like: build, test, publish artifacts. The same as in application development, IaC should have similar steps. IaC scan tooling can be easily integrated into the CI system and made recommendations before deploying code even to the development environment.
Terraform validate command – it is a good practice to always run terraform validate against your terraform files before pushing them to your version control system. Also, this level of validation should be a part of CI pipeline.
Out of the box: integrate one of 3rd party open source scanning tools. The following tools provide static analysis for Terraform files:
Example of the integrated steps to Azure DevOps with Checkov scanning tool:
## Checkov Test Run - bash: | docker run --rm -t -v $(System.DefaultWorkingDirectory):/terraform bridgecrew/checkov --directory /terraform --skip-check CKV_AZURE_35,CKV_AZURE_13 -o junitxml > $(System.DefaultWorkingDirectory)/junit.xml sed -i '$d' $(System.DefaultWorkingDirectory)/junit.xml sed -i '$d' $(System.DefaultWorkingDirectory)/junit.xml displayName: 'Checkov Static Code Analysis' continueOnError: true ## Publish Test results in Azure DevOps - task: PublishTestResults@2 displayName: 'Publish Checkov Test Results' condition: succeededOrFailed() inputs: testResultsFormat: 'JUnit' testResultsFiles: 'junit.xml' searchFolder: '$(System.DefaultWorkingDirectory)' mergeTestREsults: false failTaskOnFailedTests: true publishRunAttachments: true
The ARM Template Tool Kit is a static code analyzer for ARM templates created by Microsoft. It’s an open-source PowerShell library that you can use to validate your templates against a series of test cases. These test cases are generic and designed to validate that your templates are following best practice.
## Run ARM TTK Test - task: RunARMTTKTests@1 displayName: "Run ARM Template Unit Tests" inputs: templatelocation: $(System.DefaultWorkingDirectory)\arm resultLocation: '$(System.DefaultWorkingDirectory)\results' skipTests: 'IDs Should Be Derived From ResourceIDs,Location Should Not Be Hardcoded,apiVersions Should Be Recent,Parameters Must Be Referenced,DeploymentTemplate Must Not Contain Hardcoded Uri,Outputs Must Not Contain Secrets,DependsOn Best Practices,ResourceIds should not contain' ## Publish Test results in Azure DevOps - task: PublishTestResults@2 displayName: "Publish Test Results" inputs: testResultsFormat: 'NUnit' testResultsFiles: '$(System.DefaultWorkingDirectory)\results\*-armttk.xml' condition: always()
What benefit do you think Infrastructure as Code will bring to your Business?
Use the Contacts Form section and let us know your thoughts.
As more companies are looking to move to the cloud, there exists a great opportunity to adopt IaC. This approach allows for a consistent and clear look at what is being created, where, and most importantly, why. If you’re using IaC, then you’ll have an advantage in getting your infrastructure and applications out there.