Search for a command to run...
Passionate engineer with a decade of experience in the cybersecurity industry. Enjoy piecing together solutions involving many moving parts. Big fan of the 'It finally works!' your brain yells when a complex project comes together. Love all things cloud, security, and containerized.
No comments yet. Be the first to comment.
As I type this, I’m scrolling the news and came across yet another vulnerability with an AI tool that removes the tools' safeguards, allowing malicious commands to be run. The rate that these vulnerabilities are occurring is a bit scary but unsurpris...
A simple example of Go modules and binaries
Look directly into ETCD, the backbone of your Kubernetes cluster
The AWS Documentation is vague on this subject, so this guide will detail the relationship between SecurityHub and Config. It's assumed that knowledge of what SecurityHub and AWS Config are is present. What will follow is based on AWS best practices....
AWS KMS is one of those services that works tirelessly in the background but doesn't get a lot of love. It's common to automatically encrypt every service as part of development and infrastructure-creation workflow, and this usually happens through K...
Terraform is an open-source product used widely across the industry for infrastructure deployments. There have been recent moves across various organizations to shift to a more proactive approach to maintaining infrastructure and having to deal with draft (changes that are made to resources outside of Terraform).
For example, if you create an S3 bucket with no tags, Terraform now maintains that configuration in it's state file. If someone manually adds a tag to the S3 bucket via the console, your code will not reflect it. Now, the bucket has a configuration that is different from yours defined in code, the states do not match. Doing a terraform plan or refresh will update the state to include those tags, then doing an apply will proceed to bring your state back in line with your original configuration (aka: no tags), however, this is not an active process. You manually have to run that refresh command, or at least a deployment via terraform plan to catch it.
This blog is going to detail the process of writing a custom 'reconciler' in Go (could be thought of more as a Terraform wrapper) that will automatically refresh your Terraform state to maintain a type of deployment similar to Kubernetes: our .tf files will be the single source of truth. The reconciler will work to always ensure our AWS infrastructure matches our original configuration.
What we need to do:
Read in Terraform config files (.tf) to understand the desired state
Generate a desired_state.tfstate file that contains what our desired state should look like
Do the following continuously in a control loop:
Perform a Terraform refresh which will update the state file
Create an actual_state.tfstate file that represents the actual state
Do a diff between the two
If changes happened between the desired state and actual state, do a terraform re-deploy
cmd/
terraform/
main.go
config/
config.go
examples/
<various example .tfstate files>
scripts/
terraform/
<various example .tf files>
state.go
error.go
go.mod
Reading a state file is relatively simple using https://mholt.github.io/json-to-go/ to convert the state json into a structure.
This blog will be updated periodically as I go through the process. Stay tuned for more.