terraform-security

Guide secure development, scanning, and deployment of Power Platform Terraform modules.

Updated Mar 31, 2026

Search Tags:#security #credentials #terraform #static-analysis #oidc #dlp #power-platform

Ready to run

npx skills add https://github.com/rpothin/terraform-powerplatform-res-tenantsettings --skill terraform-security-rpothin

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: terraform-security
Source: https://github.com/rpothin/terraform-powerplatform-res-tenantsettings/tree/main/.agents/skills/terraform-security
Command: npx skills add https://github.com/rpothin/terraform-powerplatform-res-tenantsettings --skill terraform-security-rpothin

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security guidance for Power Platform Terraform modules helps developers and security engineers establish strong security practices across module design, review, and deployment.

Core Features & Use Cases

Credential handling best practices to avoid hard-coded secrets and ensure secrets are sourced from environment variables or secret stores.
OIDC authentication guidance for CI/CD pipelines and remote state management to enable least-privilege access.
Static analysis and vulnerability scanning using tools like Trivy to detect misconfigurations and known-CVE patterns.
Input validation patterns and policy checks to enforce correct resource configurations and prevent risky defaults.
State protection and governance guidance, including remote backend encryption and access controls.
DLP considerations for connectors and policies to ensure data movement complies with organizational rules.

Quick Start

Review and apply these security practices to your existing Terraform modules, starting with credentials handling and OIDC setup.

Frequently Asked Questions about terraform-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I secure credentials in Terraform modules for Power Platform?▼

Secure credentials in Terraform modules by avoiding hard-coded secrets and sourcing them from environment variables or designated secret stores. This practice prevents accidental exposure and ensures sensitive data is managed safely across module lifecycles.

How does OIDC authentication work for Power Platform Terraform deployments?▼

OIDC authentication enables least-privilege access for CI/CD pipelines and remote state management without storing long-lived secrets. It establishes trust between your pipeline and provider to securely deploy Power Platform modules.

Can I use Trivy for static analysis on Power Platform Terraform modules?▼

Yes, Trivy performs static analysis and vulnerability scanning to detect misconfigurations and known-CVE patterns in your Terraform modules. This guides you in resolving security issues before deploying to the Power Platform.

What is the best way to protect remote state for Power Platform Terraform deployments?▼

Protect remote state by applying backend encryption and strict access controls. This governance guidance ensures your state files containing sensitive infrastructure data remain secure from unauthorized access or tampering.

How do I align Power Platform connectors with DLP policies in Terraform?▼

Align connectors with DLP policies by validating data movement configurations against organizational rules during module deployment. This ensures your Terraform-managed Power Platform resources comply with established data loss prevention requirements.