CI/CD Terraform Full-Stack with Security Hardening

Scenario

Use this workflow when you need to automate the end-to-end deployment of a hardened web stack via GitLab CI/CD. It chains secure credential injection, declarative Terraform provisioning, and automated security hardening (security groups, ENI lockdown, least-privilege IAM) into a single pipeline, ensuring every environment is provisioned securely by default.

Integration steps

1. Inject STS Credentials: In GitLab CI/CD settings, set masked variables ALICLOUD_ACCESS_KEY_ID, ALICLOUD_ACCESS_KEY_SECRET, and ALICLOUD_SECURITY_TOKEN. Map them to a RAM Role with AliyunVPCFullAccess, AliyunECSFullAccess, and AliyunOSSFullAccess.
2. Initialize Provider: In .gitlab-ci.yml, export credentials and run:

```yaml script:

• export ALICLOUD_ACCESS_KEY_ID=$ALICLOUD_ACCESS_KEY_ID
• export ALICLOUD_ACCESS_KEY_SECRET=$ALICLOUD_ACCESS_KEY_SECRET
• export ALICLOUD_SECURITY_TOKEN=$ALICLOUD_SECURITY_TOKEN
• terraform init -backend-config="bucket=tf-state-prod"

```

1. Define Core Resources: In main.tf, declare alicloud_vpc, alicloud_vswitch, alicloud_instance, and alicloud_oss_bucket. Bind ECS to the VPC via vswitch_id and security_group_id.
2. Apply Security Group Rules: In security.tf, restrict ingress/egress:

``hcl resource "alicloud_security_group_rule" "allow_https" { type = "ingress" ip_protocol = "tcp" port_range = "443/443" security_group_id = alicloud_security_group.web_sg.id cidr_ip = "10.0.0.0/8" } ``

3. Enforce ENI Lockdown & IAM: Attach a scoped RAM policy to the ECS instance role. Restrict outbound API calls using alicloud_ram_policy with actions limited to oss:GetObject and rds:DescribeDBInstances.
4. Harden OSS Bucket: Configure oss_hardening.tf:

``hcl resource "alicloud_oss_bucket" "assets" { bucket = "prod-assets" acl = "private" server_side_encryption_rule { sse_algorithm = "AES256" } } ``

5. Execute & Validate: Run terraform plan in CI, then terraform apply -auto-approve. Verify with aliyun ecs DescribeSecurityGroupAttribute --SecurityGroupId <sg-id>.

Architecture

The GitLab CI runner acts as the control plane, authenticating via STS tokens to invoke the Alibaba Cloud Terraform Provider. Terraform orchestrates the data plane: provisioning VPC networks, attaching ECS instances to isolated subnets, and creating private OSS buckets. Security configurations (SG rules, RAM policies, OSS encryption) are applied declaratively during the same apply phase. State is stored remotely in OSS, while runtime traffic flows through locked-down ENIs to the hardened compute layer.

Prerequisites

• GitLab CI/CD runner with Docker executor and Terraform CLI v1.5+
• Alibaba Cloud account with RAM console access
• Pre-configured OSS bucket for remote Terraform state backend
• alicloud provider v1.220+ installed

Common pitfalls

• STS Token Expiration: CI jobs exceeding 1 hour fail mid-apply. Use sts:AssumeRole with extended duration or pipeline token refresh.
• Overly Permissive SGs: Default 0.0.0.0/0 on SSH/RDP exposes instances. Always restrict cidr_ip to internal CIDRs or bastion hosts.
• State Lock Conflicts: Concurrent runs corrupt terraform.tfstate. Enable OSS backend locking via lock_table or serialize CI jobs.
• Public OSS ACLs: Setting acl = "public-read" bypasses hardening. Enforce private and use signed URLs or RAM roles for access.

Typical questions

• automate terraform deploy with security hardening
• CI/CD pipeline provision and secure full stack
• terraform pipeline with security group lockdown
• 自动化terraform部署并加固安全
• CI/CD一键部署并配置安全策略
• terraform gitlab pipeline deploy and harden
• provision VPC ECS OSS then lock down via pipeline
• automate infra deploy with built-in security

Q: How does the CI/CD pipeline automate Terraform deployment and apply security hardening? A: It automates the entire Terraform lifecycle from credential configuration to provisioning a full web application stack while baking security hardening directly into the pipeline stages. This ensures infrastructure is automatically provisioned and hardened by default through applied security group rules, ENI lockdown, and least-privilege access policies on every deployment.