Collection of custom checkov policies to prevent IAM changes via Terraform
-
Download checkov
pip3 install checkov
-
Clone this repository (optional)
git clone https://github.com/tmprender/checkov-iam-lockdown
-
Run checkov using custom policies
checkov -d example/ --external-checks-dir checkov-iam-lockdown/gcp
or reference git repo directly...
checkov -d example/ --external-checks-git https://github.com/tmprender/checkov-iam-lockdown/aws
Configure separate pipeline to manage IAM changes. Simply...
check for iam changes in tf plan
terraform show -json tfplan.plan | jq '.planned_values.root_module.resources[] | select(.type | contains ("iam"))'
and forward the resulting output to a meaningful location.