What are the Use Cases of Terrascan?

Here are some common use cases of Terrascan as seen below.

1. Code Scanner

You can scan a variety of IaC using Terrascan. Consider this example where you have a file called “main.tf”.

Python3

provider "azurerm" { 
  features {} 
} 
resource "azurerm_resource_group" "example" { 
  name     = "example-resources"
  location = "UK South"
}

You can scan and detect vulnerabilities in this Azure infrastructure using Terrascan. By running the “terrascan -f” command, you can scan any Terraform code as shown below.

You can also use Terraform’s sandbox environment in your browser by clicking this link to scan your Terraform code.

A snippet of the JSON code to be checked in terraform environment:

Python3

provider "azurerm" { 
  features {} 
} 
resource "azurerm_storage_account" "my_storage_account" { 
  name                     = "myteststorageaccount"
  resource_group_name      = "myresourcegroup"
  location                 = "westus2"
  account_tier             = "Standard"
  account_replication_type = "LRS"
} 
resource "azurerm_virtual_network" "vnet_prod" { 
  name                = "vnet-prod"
  address_space       = ["10.0.0.0/16"] 
  location            = "westus2"
  resource_group_name = "myresourcegroup"
  tags = { 
    Name = "vnet-prod"
  } 
}

Output

This works for all file extensions such as JSON, YAML, tf and so on.

2. Helm Chart Scanner

You can create Helm charts using the command.

helm create demo-chart

You’ll have a YAML (Yet Another Markup Language) called “values” where you can edit some values to create some vulnerabilities that Terrascan can report. You can detect vulnerabilities in Helm Charts using Terrascan.

Suppose you have the YAML code below:

Python3

Resources: 
  MyPod: 
    Type: AWS::ECS::TaskDefinition 
    Properties: 
      ContainerDefinitions: 
        - Name: my-container 
          Image: busybox 
          Command: 
            - sh 
            - "-c"
            - "while true; do echo 'Hello, World!'; sleep 1; done"
          Memory: 128
          Cpu: 0.5

Output

3. Scanning Kubernetes Code

You can check the ability and safety of Kubernetes manifests that you’ve created in CFT (CloudFormation Template). Suppose you have a code to deploy a simple nginx deployment:

Python3

Resources: 
  NginxDeployment: 
    Type: AWS::ECS::TaskDefinition 
    Properties: 
      ContainerDefinitions: 
        - Name: nginx 
          Image: nginx:latest 
          Memory: 64
          Cpu: 0.1
      Family: nginx-deployment

Due to its low resource requirement, this will be flagged as a major violation. To spend the right resources in Infrastructure and distribute them properly, unusually low resources will also be flagged as a violation as seen below.

Output

4. Integration with ArgoCD

You can configure Terrascan as an ArgoCD using two methods.

Scan the remote repository after configuring Terrascan as an ArgoCD pre-sync hook.
Deploy an already deployed Terrascan server into a Kubernetes (K8) cluster and scan remote repositories available in ArgoCD’s PreSync Hook.

Must Read

What is Infrastructure as Code (IaC)?

What is Terraform?

Infrastructure As Code Using Pulumi

What is Terrascan? Features, Installation and Use Cases

Terrascan is a popular software used to detect any possible vulnerabilities in IaC (Infrastructure as Code) structures. With its predefined built-in policies, Terrascan can detect any vulnerabilities in your code and let you know about the policy violations in detail, including their severity. The violations can range from minor infractions to severe structural compromises detected in the code. Before we go into detail, let’s see more about Terrascan.