The IaC Supply Chain Nobody's Securing: Modules, SBOMs, and Version Governance

Your Terraform modules have no lock file. No cryptographic signing. No integrity verification. And they run with full cloud credentials. In this video, I walk through the IaC supply chain security gap that most teams are ignoring — and how to fix it with CycloneDX SBOMs, OPA/Rego governance policies, and automated enforcement in CI/CD. What you'll learn: 🔴 Why IaC modules are more dangerous than npm packages (higher privileges, weaker protections) 🔴 Real supply chain incidents: registry attacks, GPG key expiration, typosquatting risks 🏢 Enterprise patterns: public registry, private registry, forks, artifact proxies — and what each one actually mitigates 📦 How to generate CycloneDX 1.6 SBOMs for your entire IaC inventory (modules + providers) 🔒 OPA/Rego policies: pin enforcement, staleness gates, approved source provenance 🛠️ Live demo: ThothCTL inventory + workflow engine in action Works with Terraform, OpenTofu, and Terragrunt. 📝 Full blog post: [link] 🔧 ThothCTL (open source): https://github.com/thothforge/thothctl (https://github.com/thothforge/thothctl) 🐙 ThothForge org: https://github.com/thothforge (https://github.com/thothforge)