Terraform Enterprise (Run Tasks)
Integrate Prisma Cloud with Terraform Enterprise (Run Tasks) to allow dynamic, automated, and context-specific scans in your Terraform workspace.
With the integration of Terraform Enterprise, Prisma Cloud, scans your Terraform frameworks to identify misconfigurations based on Prisma Cloud’s default policies, as well as custom policies created by your organization for specific needs. This scanning process occurs whenever changes are pushed or triggered in your workflow, ensuring security checks are integrated seamlessly. Prisma Cloud identifies issues such as misconfigurations in your infrastructure-as-code (IaC) files, software composition analysis (SCA) vulnerabilities*, exposed secrets, and license non-compliance as soon as they are introduced.
*Prisma Cloud performs 'Image Referencer scans to analyze the contents, dependencies, and configurations of container images in order to detect known vulnerabilities, as full SCA scans are not supported for Terraform Enterprise (Run Tasks).
Runs in Terraform are performed within a workspace, or a working directory when running Terraform locally. The workspace provides providing the configuration, state, and variables for the run. Terraform Enterprise maintains a run queue, processing runs sequentially. Each run progresses through multiple run stages; pending, plan, cost estimation, policy check, apply, and completion.
Users can monitor the run status (pass/fail) and remediate issues directly on the Prisma Cloud console. Prisma Cloud offers automated shift-left actions such as notifying developers or creating tickets, based on scan results. In addition, you can track the run status on Terraform Enterprise through streamlined run task reviews, which offer detailed descriptions of violations and fixes provided by Prisma Cloud within their Terraform deployment environment. For more information about streamlined tasks, refer to https://www.hashicorp.com/blog/terraform-cloud-adds-streamlined-run-task-reviews.
The following integration includes workflows involving third party tools such as Terraform and GitHub. These are general guidelines only, intended to help you. You must always follow the official third party documentation.
Before you begin.
Terraform Enterprise Console: Ensure access to a Terraform Enterprise console to enable you to provide a user or team token that authorizes Prisma Cloud to access workspaces and helps regulate run configurations in the Terraform console
Terraform Enterprise version compatibility: Ensure Run Tasks for workspaces on Terraform Enterprise is compatible with version 1.1.9 and above
Terraform Enterprise user or team permission: For a workspace integration of run tasks you need to ensure that the token used has thehttps://developer.hashicorp.com/terraform/enterprise/users-teams-organizations/permissions#organization-permissions[Manage Run Tasks permissions]. The token must have the Manage run tasks permission at the organization level, and either: Manage Workspaces permissions at the organization level or Administrator permissions on the workspace(s) that will be integrated. Manage run tasks is required to create and manage the run task in the organization, and the workspace permissions are required to attach and manage the run task on workspaces.
Create a Terraform Organization.
For information on creating Terraform organizations, refer to the Terraform documentation.
Create a Terraform Workspace.
For information on creating Terraform workspaces, refer to the Terraform documentation.
On the Prisma Cloud Application Security console.
In Application Security, select Home > Settings > Connect Provider > Code & Build Providers.
Select Terraform Enterprise (Run Tasks) (under CI/CD Runs) in the catalog that is displayed.
The Configure Account step of the integration wizard is displayed.
Fill in the provided fields:
Add your Terraform User or Team token in the provided field
Add your Domain.
Ensure that your IP address and your Terraform Enterprise URL are on the allow list for Prisma Cloud. For more about the allow list see allow list.
Select Next.
The Select Organization step of the integration wizard is displayed.
Select a Terraform organization from the menu to establish webhook integrations with Prisma Cloud for Terraform > Next.
The Select Workspace step of the integration wizard is displayed.
In the Select Workspace step.
Select a Terraform workspace to scan during the Terraform Enterprise run lifecycle.
You can select multiple workspaces for Prisma Cloud to scan during the Terraform Cloud run lifecycle. Each integration can only be associated with a single Terraform Cloud organization at any given time. However, you can create multiple integrations with multiple Terraform Enterprise organizations from a single Prisma Cloud account.
Select an option from the Run Stage list:
Post-plan: The scan runs after Terraform generates the plan
Pre-plan: The scan runs before Terraform generates the plan
Prisma Cloud performs a scan of Terraform templates on selected workspaces based on the Run Stage.
Select Next.
The Status step of the integration wizard opens, displaying an integration status message.
Select Done.
On completing the integration, an event hook is created in the Terraform organization to receive run task notifications on Prisma Cloud.
Verify integration: In Application Security, select Home > Settings > CI/CD Runs tab.
Your integrated Terraform repositories will be displayed.
A Terraform Enterprise run may fail if a Run Task configuration for a workspace is set at Mandatory. You can re-configure the severity level using Enforcement.
Next step: Monitor and manage scan results.
Following the integration, the subsequent Terraform scan will automatically incorporate the selected repositories.
To view scan results and resolve issues, select Application Security > Projects > CI/CD Runs tab. See Monitor Code Build Issues for more information.
Manage Integrations
You can view, modify, delete and add integrations. Additionally, it’s important to regularly rotate integration tokens for security purposes.
Access Integration Management
To access integration management, in Application Security, select Settings > Connect Provider > Code & Build Providers > Terraform Enterprise (Run Tasks) (under CI/CD Runs).
The Terraform Cloud Run Tasks popup opens, displaying a list of configured accounts.
Modify Integrations
Modify existing integrations by choosing an alternative workspace.
Select the menu under the Actions column of an account.
Click Reselect workspaces.
The Select Workspace step of the integration wizard is displayed.
Select a workspace and complete the remaining steps in the integration wizard.
Add Integrations
Add additional integrations as needed to expand your workflow.
Select the menu under the Actions column of an account.
Select Add an account.
The Configure Account step of the integration wizard is displayed.
Repeat the integration process above.
View Integrations
View a list of integrations on a single console.
The Terraform Cloud Run Tasks popup displays a list of integrations,including their domain name, organization and workspace.
Delete Integrations
Select the menu under the Actions column of an organization.
Click Delete integration.
If you have a single integration within the account, deleting the existing integration will delete the account configuration on Prisma Cloud console.
Secure Communication with Transporter for Terraform Enterprise (Run Tasks)
The Transporter serves as a communication proxy or broker, facilitating a secure channel between Prisma Cloud and Terraform Enterprise (Run Tasks). This enables seamless integration and management of Terraform Enterprise within your infrastructure while maintaining stringent security measures. For more information on integrating Terraform Enterprise (Run Tasks) with Transporter, refer to the Transporter documentation.
Rotate Integration Tokens
Rotate integration tokens to enhance security and prevent unauthorized access.
Create a PUT request: PUT /code/api/v1/integration/token/<integration_id> with the following body:
To find your <integration_id>:
Select the menu under the Actions column of an account.
Click Reselect workspaces.
The integration ID is displayed in the URL bar on the Select Workspace step of the integration wizard.
Last updated
Was this helpful?