terrascan

Terrascan is a static code analyzer for Infrastructure as Code. It can be installed and run in a number of different ways, and is most commonly used in automated pipelines to identify policy violations before insecure infrastructure is provisioned.

Installing Terrascan

• Download terrascan from below url as per your operating system https://github.com/tenable/terrascan/releases

macOS and Linux

$ curl -L "$(curl -s https://api.github.com/repos/tenable/terrascan/releases/latest | grep -o -E "https://.+?_Darwin_x86_64.tar.gz")" > terrascan.tar.gz
$ tar -xf terrascan.tar.gz terrascan && rm terrascan.tar.gz
$ install terrascan /usr/local/bin && rm terrascan
$ terrascan        

Windows

tar -zxf terrascan_<version number>_Windows_x86_64.tar.gz        

• Download from above mentioned url and run below command and put on you infracode folder. screenshot for your reference

• After that run terrascan scan command for get report . screenshot for reference

Terrascan can be integrated into many tools in the development pipeline. When integrated into a tool, vulnerability scanning is automated as part of the commit or build process. It can run on a developer’s laptop, a SCM (e.g. GitHub), and CI\CD servers (e.g. ArgoCD and Jenkins). It also has a built in Admission Controller for Kubernetes.

Architecture

Terrascan’s architecture is built to be modular to facilitate adding IaC languages and policies. At a high level Terrascan is composed of the following architectural components: a command line interface, API server, runtime, pluggable IaC providers, pluggable policy engine, notifier, and writer.

• Command Line Interface = Provides CLI input to Terrascan.
• API Server = Provides input to Terrascan through an API.
• Runtime = Performs input validation and process inputs
• IaC Providers = Converts IaC language into normalized JSON
• Policy Engine = Applies policies against normalized JSON
• Notifier = Provides webhooks for results of Terrascan scans.
• Writer = Writes results into various formats like JSON, YAML, or XML.