DevSecOps¶

A misconfiguration caught in the pipeline costs a code review comment; the same misconfiguration caught in production costs an incident and someone's weekend. This section covers baking verification into the infrastructure pipeline instead of auditing after launch. Four tools carry the weight: format, lint, scan, plan, apply — then regenerate the docs so they describe what actually exists rather than what someone meant to build.

The Pipeline¶

DevSecOps is not a dashboard, a role, or a meeting. It is a habit: every infrastructure change passes automated gates before it touches the cloud, and documentation refreshes after every apply so it never lies. The stages run in a fixed order because each one assumes the previous stage passed:

graph LR
    A[fmt] --> B[tflint]
    B --> C[checkov]
    C --> D[plan]
    D --> E[review]
    E --> F[apply]
    F --> G[terraform-docs]

Each gate catches a different class of failure:

Linting before scanning feeds the scanner valid code. Scanning before plan means the reviewed plan describes code that already passed policy. Documenting after apply captures reality, not intention. Run the stages out of order and you get false confidence — which is worse than no confidence, because nobody goes looking for problems the tools already claimed to have checked.

Reference¶

Documentation:

• Terraform Docs
• OpenTofu
• Terraform Release Tracker

Related:

• Terraform
• tflint
• checkov
• terraform-docs

Last Updated: 2026-08-22 | Vibe Check: Pipeline Mindset - four tools, one habit: verify before apply, document after.

Tags: iac, devsecops, automation