terraform-secure-railguard-available

Overview

This rule provides secure-by-default conventions for Terraform projects, focused on:

• Multi-environment infrastructure deployment (e.g., dev, staging, prod)
• Separation of concerns through modular component structure
• Validation of all input and deployed resources
• Secure secret handling and backend configuration
• Encryption of data at rest and in transit
• Principle of least privilege for all IAM interactions

Note: Input validation logic is delegated to:

.cursor/rules/railguard-input-validation.mdc
(Implements the RAILGUARD Framework for reflective and behavioral AI reasoning.)

---

Code Validation and Resource Governance

• Validate all external code and modules before use. Trust must be established for source and content.
• Always use HTTPS or SSH for module sources — avoid unsecured sources.
• Inputs must be declared in a dedicated .tf file, typed, and validated.
• Add extra validation logic if input trust is unclear or incomplete.
• Avoid generation of high-cost resources unless explicitly scoped to critical workloads.
• Version pin all providers and modules (~>, >=, avoid latest).
• All code must pass static scanning tools like tfsec, Checkov, or Terrascan.
• Annotate outputs or critical code with security comments (e.g., # encrypted, # least privilege).

---

Input Validation

All input validation (schema, type, behavioral assumptions) is enforced globally via:

.cursor/rules/railguard-input-validation.mdc

This includes:

• Dangerous input detection
• Variable schema enforcement
• Secure interpretation and reasoning scaffolding

---

Secrets and Sensitive Data

• All API keys, tokens, and credentials must be stored in Vaults or environment variables.
• Do not hardcode sensitive values or place them in .tfvars or Terraform files.
• Mark sensitive outputs using sensitive = true.
• Terraform state must be stored in secure, encrypted remote backends (e.g., S3 + DynamoDB, GCS).
• Add .gitignore rules to exclude sensitive config or .tfstate files locally.
• Use secure hashing algorithms for secret comparison or ID generation.