Supply chain attacks in the Terraform Registry

Note: This session is included in the conference ticket, but specific program has not been finalised.

Terraform has quickly become one of the most popular IaC tools, gaining a large community that develops and maintains thousands of reusable open-source modules. Modules are one of the core features of Terraform and support rapid infrastructure configuration.

The Terraform Registry is the primary resource for retrieving modules. Unfortunately, the registry is woefully insecure to supply chain attacks, allowing any module author to modify the module’s files without changing the module’s version in the registry. During this talk, Kyle provides a live demonstration of how module authors can exploit this vulnerability to retrieve sensitive data about your infrastructure or make malicious modifications. He’ll review the options for defending against these attacks along with their strengths and weaknesses.