Terraform Cloud (Run Tasks)

Integrate Cortex Cloud Application Security with Terraform Cloud (Run Tasks) to enable dynamic, automated, and context-specific scans in your Terraform workspace. Cortex Cloud Application Security scans Terraform (TF) frameworks for misconfigurations based on default and custom policies whenever changes are triggered, ensuring seamless security checks. It identifies issues such as infrastructure-as-code (IaC) misconfigurations, Software Composition Analysis (SCA ) vulnerabilities, exposed secrets, and license non-compliance, depending on the security scanners that you have subscribed to.

You can monitor and remediate issues directly in the Cortex Cloud Application Security console. Run statuses and violation details can be tracked in both Cortex Cloud Application Security and Terraform Cloud through streamlined run task reviews. For more information about streamlined tasks, refer to https://www.hashicorp.com/blog/terraform-cloud-adds-streamlined-run-task-reviews.

Prerequisites

Before you begin:

• User permissions: Ensure the user performing the integration has permissions to edit pipeline configurations (such as YAML files) and manage secrets/credentials within the CI platform to store the Cortex Cloud API key securely
• Procure a Terraform cloud license that is either a trial license or a TF Cloud license at the TEAM & GOVERNANCE level
• Terraform permissions: Grant the user or team the following permissions, depending on integration:

  • Manage Workspaces permissions at the organization level. These permissions are required to attach and manage the run task on workspaces or:
  • Administrator permissions on the workspace(s)
• Create a Terraform Organization. For more information, refer to theTerraform documentation
• Create a Terraform Workspace: For more information, refer to the Terraform documentation
• Egress path: Create an egress path to establish the designated route for outbound data transmission from Cortex Cloud to third party services. For more information about configuring egress paths, refer to Egress configurations

Onboarding steps

1. On your Terraform Cloud platform, create a Terraform api token.

   1. Select your user/profile icon → User Settings.
   2. Select the Tokens section from the left side menu.
   3. Click Create an API token → provide a description → Create API token .
   4. Copy and save the token+ Done.

      Note

      Skip this step if you plan on using an existing token.

   For more information about Terraform API tokens, refer to the Terraform API Tokens documentation.
2. On the Cortex Cloud console.

   1. Select Settings → Data Sources & Integrations → + Add New.
   2. Search for and hover over Terraform Cloud (Run Tasks) and click Add, or Add Another Instance if an instance is already onboarded.
3. Provide your Terraform user or team API token on the Configure Account step of the wizard → Next.
4. Select an organization from the Select Organization step of the wizard → Next.
5. On the Select Workspace step of the wizard.

   1. Select repositories from the Selection Options field.

      • Permit all existing repositories
      • Permit all existing and future repositories
      • Choose from repository list
   2. Select a run plan from the Run Stage field.

      • Pre-plan: The scan runs before Terraform generates the plan
      • Post-plan: The scan runs after Terraform generates the plan

      Note

      Cortex Cloud Application Security performs a scan of Terraform templates on selected workspaces based on the Run Stage.
   3. Click Save and then Close in the final verification step of the wizard.

Verify integration

1. On Data Sources & Integrations page, search for Terraform Cloud (Run Tasks).
2. Select the resulting data source.
3. Locate your instance and verify that the status is Connected.

Next steps

View scan results and mitigate issues.

Terraform workflow for Run Tasks enforcement

Use the Terraform workflow for Run Tasks enforcement reference to configure policy-based enforcement.

Manage the integration

Instance-level actions

1. Navigate to Settings → Data Sources & Integrations and search for Terraform Cloud (Run Tasks).
2. Select the matching result.
3. Locate your instance from the displayed list. Right-click it, then select an option:

   • Edit instance: Opens the onboarding wizard, where you can change the instance configuration.
   • Delete instance: Deletes the instance and previous scan data.
   • Copy entire row: Copies all row values to the clipboard.

Repository-level actions

1. Locate your instance. See Instance-level actions.
2. Select the instance. A list of connected repositories appears.
3. Right-click a repository, select the required action, then select Save.