2 ms·
With a tool like Terraform, when is security not required?
by numbsafari 3y ago
With a tool like Terraform, when is security not required?
- lmeyerov 3y agoEncryption at rest of local terraform state seems beyond the threat model & compliance needs of a pre-PMF consumer startup It's a lot harder to be an enterprise company or b2b startup (SOC2) and brush that off in front of knowledgeable auditors. I'm guessing most would miss it and rely on self-reporting, which in turn raises how 'loud' this issue is for most OSS terraform users. We aren't heavy terraform users, so I'm not sure of the threat modeling here. Understanding these kinds of product decisions and OSS security ramifications is a pet interest of mine, and this is a fascinating one!