---
name: devsecops-devsecops-bp-ci-iac
title: Best practices for CI toolchain IaC
description: The implementation of continuous integration (CI) toolchain for Infrastructure as Code (IaC) DevSecOps follows these practices.
last-updated: 2024-02-22
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/devsecops?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Best practices for CI toolchain IaC
{: #practices-ci-toolchain-iac}

The implementation of continuous integration (CI) toolchain for Infrastructure as Code (IaC) DevSecOps follows these practices.
{: shortdesc}

- Runs a static code scanner on the infrastructure code repositories and performs Terraform linting checks on the infrastructure code.
- Runs compliance checks on the infrastructure code to detect secrets and security vulnerabilities.
- Builds artifacts on every Git commit.
- Stores the built artifacts metadata in the inventory repository.
- Automatically builds and validates any code that is merged into the target Git repository branch.

![DevSecOps IaC CI toolchain](images/devsecops-ci-terraform-toolchain-diagram.png){: caption="DevSecOps CI toolchain" caption-side="bottom"}