r/Terraform

Hey everyone!

Back in 2020, I created a small Terraform provider called uname as a helper for a few projects I was working on.

Fast-forward to today, and it just reached 200,000 downloads! 🎉

It's kind of funny that the smallest open-source project I maintain has turned out to be the most popular one. 😄

A big thank you to everyone who has used it, recommended it, or incorporated it into their infrastructure workflows. It's really cool to see something you built for your own needs end up being useful to other people!

For those unfamiliar with it, the provider exposes host kernel and architecture information through Terraform data sources and provider functions. It also works with OpenTofu.

Some use cases include:

• Detecting the host OS and architecture to download the right binaries during provisioning
• Infrastructure testing and compliance checks
• Infrastructure inventory
• And probably a few use cases I haven't even thought of!

Repository: https://github.com/julienlevasseur/terraform-provider-uname

Since I'm sharing, I'd also like to introduce another personal open-source project of mine: Profiler.

Profiler solves a different, everyday developer problem: managing shell environment variables.

You can save your shell environment as named profiles and switch between them with a single command. It's handy when working across multiple projects, switching between development environments, or managing different sets of environment variables without manually exporting everything over and over. (supports also .env and auto kubectl namespace switch)

If that sounds useful, give it a look!

Repository: https://github.com/julienlevasseur/Profiler

Thanks again for the support, and happy hacking! 🙂

So i built a deliberately vulnerable stack in Terraform to mirror the actual AWS-side misconfiguration from the Capital One breach, not the ssrf bug itself !!, that was application-layer, but the two settings that turned it into 106 million exposed records: an EC2 instannce still accepting unauthenticated IMDSv1 requests...., with an IAM role attached granting broader S3 access than the instance needed.

writing this as code surfaced something worth shariing on its own. If you fix a misconfiguration like this by hand, live, outside your Terraform state, aws ec2 modify-instance-metadata-options directly, say, the next terraform apply can silently revert it back to whatever the .tf file still says. A real fix needs to go into the actual resource block, http_tokens = "required" on the instance's metadata_options, not a one-off CLI command patched onto a live resource.

then i Ran Plexavo, an open source AWS cloud security intelligence tool i built, against the stack afterward to confirm the chain traced correctly end to end, internet-facing instance, unauthenticated metadata, over-permissioned role, straight into the bucket.

Repo if anyone wants to see the actual checks: https://github.com/plexavo/Plexavo