Terraform Enterprise Security Model
This page explains the aspects of the Terraform security model that are unique to Terraform Enterprise. We recommend also reviewing the core concepts in Terraform Cloud Security model.
In addition to those listed in Terraform Cloud Security model, Terraform Enterprise requires the following personas for managing and administering the application.
Outside of the application, administrators of the Terraform Enterprise deployment are responsible for managing the underlying infrastructure, upgrading the application, and configuring Terraform Enterprise either via the Replicated admin console or by editing the application settings file.
Terraform Enterprise grants extensive permissions to this role, so we recommend limiting the number of users who are infrastructure admins in your organization.
Site admins are responsible for application-level configuration of Terraform Enterprise. They can manage all users, workspaces, and organizations through the admin interface and have access to all data stored within Terraform Enterprise. Site admins are also responsible for configuring SAML and are the only users that can access Terraform Enterprise with a username and password once SAML is configured.
Terraform Enterprise grants extensive permissions to this role, so we recommend limiting the number of users who are site admins in your organization.
All of the content on Terraform Cloud security model applies to Terraform Enterprise, with the exception of the points listed below.
Infrastructure admins are required to manage all aspects of the underlying infrastructure. This includes initial provisioning, secure configuration, access control, network ACL configuration, and OS-level software updates. Terraform Enterprise cannot ensure the security of your data if the underlying infrastructure is compromised.
We release security fixes, application features, and bug fixes for Terraform Enterprise each month. Infrastructure admins are responsible for applying updates.
Infrastructure admins are responsible for all aspects of reliability and availability. Refer to Terraform Enterprise documentation on monitoring, backups and restores, and high availability mode (active/active) for more guidance on this topic.
Unlike Terraform Cloud, Terraform Enterprise performs all Terraform operations in Docker containers on the Terraform Enterprise host. The containers are assigned to an isolated Docker network to prevent them from communicating with Terraform Enterprise backend services. However, Terraform Enterprise does not perform any egress filtering, so Terraform runs can still access available network resources.
Terraform Enterprise Relies on Third Party Software for Licensing, Delivery, Installation, and Management
Terraform Enterprise is built on top of a software platform developed by Replicated. The components necessary for installing Terraform Enterprise are hosted by Replicated, and software developed by Replicated is used for bootstrapping, configuring, and managing every Terraform Enterprise deployment. For more information, see Security at Replicated.
In addition those provided in the Terraform Cloud security model, we recommend the following for Terraform Enterprise users.
Run Terraform Enterprise in an Isolated Network, Limit Ingress Ports, and Restrict Access to Underlying Infrastructure
To minimize attack surface, we recommend running Terraform Enterprise in an isolated network and limiting ingress ports to only 80 and 443, as documented in Network Requirements for Terraform Enterprise.
Additionally, we recommend restricting access to the nodes that are running Terraform Enterprise. Terraform Enterprise can not ensure the security or integrity of your data if the underlying infrastructure is compromised.
Once you are ready to use Terraform Enterprise for production workloads, we recommend enabling these optional security features.
You can configure Terraform Enterprise to set the Strict Transport Security (HSTS) header by:
- Visiting the installer dashboard "Settings" page and enabling “Force TLS” under the “SSL/TLS Configuration” section.
- Setting force_tls in the application settings file.
Note: Once properly configured, the HSTS header cannot be disabled and will prevent clients from accessing your Terraform Enterprise domain via HTTP or HTTPS using a self-signed cert. We recommend only enabling this setting for production Terraform Enterprise deployments.
Terraform Enterprise allows site admins to enable global remote state sharing, which allows any workspace to access the state versions of any other workspace within the same organization. We recommend disabling this feature and relying on controlled remote state access if you need to share state between workspaces.
Terraform Enterprise uses support bundles to share diagnostic information with HashiCorp support. Please note that support bundles may contain sensitive information from your Terraform Enterprise installation. You should not share them with untrusted parties and should delete them as soon as possible.
We release Terraform Enterprise updates each month. Updates may contain additional security features or fixes for existing security vulnerabilities, so we recommend establishing a process for periodically updating your Terraform Enterprise installation.
We publish updates that address security vulnerabilities in HashiCorp products. You can find them in the Security category of HashiCorp Discuss.
We recommend that Terraform Enterprise infrastructure admins follow the documented steps to subscribe to email notifications or the RSS feed for Terraform Enterprise security updates.
By default, Terraform Enterprise does not prevent Terraform operations from accessing the instance metadata service, which may contain IAM credentials or other sensitive data. Refer to AWS, Azure, or Google Cloud documentation for more information on this service.
Terraform Enterprise allows you to restrict access to the metadata endpoint from Terraform operations, preventing workspaces from reading any data from the metadata service. You can do this by:
- Visiting the installer dashboard "Settings" page and enabling “Restrict Terraform Build Worker Instance Metadata Access” under the “Advanced Configuration” section.
- Setting restrict_worker_metadata_access in the application settings file.
We recommend enabling this setting to prevent Terraform operations from accessing the instance metadata endpoint, unless you are relying on the instance profile to provide default credentials to workspaces.
For standalone deployments, port 8800 is reserved for the Replicated admin console, which is used for configuring Terraform Enterprise. This port should only be exposed to infrastructure admins. If you choose to configure Terraform Enterprise with the automated process, you can disable the Replicated admin console by passing the
disable-replicated-ui argument to the installation script:
sudo bash ./install.sh disable-replicated-ui