Terraform Code Reviews: Supercharged with Conftest

One of the biggest bottlenecks for creating and updating infrastructure with Terraform is often Code Reviews.

Doordash's Case Study

A developer would open a PR to add some new infrastructure, they'd ping security for review, they'd wait, they'd wait, they'd ping again, they'd get a review, their branch was out of date, they would update their branch, they'd require a new review, they'd ping security, etc. All of this to just update some Security Group rules in AWS.

To alleviate these pains, Doordash implemented some predefined security policies and used conftest to check for policy violations on each PR. If there were no policy violations, security approval was not required. This approach greatly increased the speed at which developers were able to deploy new infrastructure and gave the security team a great deal of time back.

What You'll Learn

In this talk, you'll see how Doordash deploys infrastructure, show a quick example policy in action, and share some basic recipes for automating away some of those mundane code reviews.

Slides