Terraform Enterprise (Run Tasks)

Integrate Cortex Cloud Application Security with Terraform Enterprise (Run Tasks) to enable dynamic, automated, and context-specific scans in your Terraform workspace. Cortex Cloud Application Security scans Terraform (TF) frameworks for misconfigurations based on default and custom policies whenever changes are triggered, ensuring seamless security checks. It identifies infrastructure-as-code (IaC) misconfigurations, Software Composition Analysis (SCA ) vulnerabilities^(*), exposed secrets, and license non-compliance issues, depending on the security scanners that you have subscribed to.

Note

For container image vulnerabilities, Cortex Cloud Application Security performs 'Image Referencer' scans within Terraform Enterprise (Run Tasks), as full SCA scans are not currently supported.

You can monitor and remediate issues directly in the Cortex Cloud Application Security console. Run statuses and violation details can be tracked in both Cortex Cloud Application Security and Terraform Enterprise through streamlined run task reviews. For more information about streamlined tasks, refer to https://www.hashicorp.com/blog/terraform-cloud-adds-streamlined-run-task-reviews.

Prerequisite

Before you begin:

• Ensure access to a Terraform Enterprise console to enable you to provide a user or team token that authorizes Cortex Cloud Application Security to access workspaces and helps regulate run configurations
• Terraform Enterprise version compatibility: Ensure Run Tasks for workspaces on is compatible with version 1.1.9 and above
• Terraform Enterprise user or team permissions: For a workspace integration of run tasks you need to ensure that the token used has the following permissions. These permissions enable Cortex Cloud to configure run tasks in the environment and scan plan files from your runs:

  • Manage run tasks permissions at the organizational level. These permissions are required to create and manage the run task in the organization
  • Manage Workspaces permissions at the organization level. These permissions are required to attach and manage the run task on workspaces or:
  • Administrator permissions on the workspace(s)

    Note

    For more on Terraform Run Task permissions refer to Manage Run Tasks permissions.
• Create a Terraform Organization. For more information, refer to theTerraform documentation
• Create a Terraform Workspace: For more information, refer to the Terraform documentation
• Egress path: Create an egress path to establish the designated route for outbound data transmission from Cortex Cloud to third party services. For more information about configuring egress paths, refer to Egress configurations

Onboarding steps

1. On your Terraform Enterprise platform, create a Terraform api token.

   1. Select your user/profile icon → User Settings.
   2. Select the Tokens section from the left side menu.
   3. Click Create an API token → provide a description → Create API token .
   4. Copy and save the token+ Done.

      Note

      Skip this step if you plan on using an existing token.

   For more information about Terraform API tokens, refer to the Terraform API Tokens documentation.
2. On the Cortex Cloud console:

   1. Navigate to Settings → Data Sources & Integrations → + Add New.
   2. Search for and hover over Terraform Enterprise (Run Tasks) and click Add, or Add Another Instance if an instance is already onboarded.
3. Provide your Terraform user or team API token on the Configure Account step of the wizard → Next.
4. Select an organization from the Select Organization step of the wizard → Next.
5. On theSelect Workspace step of the wizard:

   1. Select repositories from the Selection Options field.

      • Permit all existing repositories
      • Permit all existing and future repositories
      • Choose from repository list
   2. Select a run plan from the Run Stage field.

      • Pre-plan: The scan runs before Terraform generates the plan
      • Post-plan: The scan runs after Terraform generates the plan

      Note

      Cortex Cloud Application Security performs a scan of Terraform templates on selected workspaces based on the Run Stage.
   3. Click Save.
6. Click Save and then Close in the final verification step of the wizard.

Verify integration

1. On the Data Sources & Integrations page, search for Terraform Enterprise (Run Tasks).
2. Select the resulting data source.
3. Locate your instance and verify that the status is Connected.

Next steps

View scan results and mitigate issues.

Terraform workflow for Run Tasks enforcement

Use the Terraform workflow for Run Tasks enforcement reference to configure policy-based enforcement.

Manage the integration

Instance-level actions

1. Navigate to Settings → Data Sources & Integrations and search for Terraform Enterprise (Run Tasks).
2. Select the matching result.
3. Locate your instance from the displayed list. Right-click it, then select an option:

   • Edit instance: Opens the onboarding wizard, where you can change the instance configuration.
   • Delete instance: Deletes the instance and previous scan data.
   • Copy entire row: Copies all row values to the clipboard.

Repository-level actions

1. Locate your instance. See Instance-level actions.
2. Select the instance. A list of connected repositories appears.
3. Right-click a repository, select the required action, then select Save.