Hey folks, John here. 👋 I've been deep in the infrastructure-as-code and security automation trenches for a while now, mostly with Ansible, Terraform, and Vault. My team is currently evaluating Snyk for our environment, and I'm hitting a bit of a research gap. Everyone talks about Snyk for startups or SaaS products, but I'm struggling to find concrete, gritty details from anyone operating at a scale similar to ours.
We're a 500-user retail chain with a mix of legacy and modern infra. Think:
* **50+ physical stores** each with POS systems (Linux-based, but locked-down vendor images).
* A central data center and a slow migration to AWS for e-commerce and internal apps.
* A sprawling codebase: legacy monoliths (Java), newer microservices (Go/Node.js), and a mountain of Python scripts for internal automation.
* CI/CD is a mix of Jenkins pipelines and some newer GitHub Actions workflows.
The promise of Snyk—shifting security left and having a unified view across code, dependencies, containers, and infra-as-code—is incredibly appealing. But between the marketing and the docs, I have some very specific, practical concerns before I can even think about a POC.
**My core questions for anyone in a similar boat:**
1. **Agent Overhead & Performance:** In a hybrid environment like ours, how heavy is the Snyk agent (if you're using it) on your build systems and runtime nodes? Does scanning a large, multi-module Maven project bring CI jobs to a crawl?
2. **Terraform Integration Depth:** We manage all cloud resources with Terraform. Does Snyk actually catch security misconfigurations in Terraform modules that are *dynamically generated*? Or does it only scan the static `.tf` files? A real-world example would be golden.
3. **Noise vs. Signal:** With hundreds of dependencies across projects, how effective are the prioritization and policy features? Are you constantly drowning in "Critical" CVEs in ancient dev libraries that are buried in code paths no one uses? How do you tune it?
4. **Operational Workflow:** How do you handle the fix flow? Do developers just get PR comments, or are you integrating Snyk fixes into your Ansible playbooks for infrastructure updates? I'm trying to visualize the actual remediation path from alert to closed ticket.
I'd be eternally grateful for any war stories or configuration snippets. For instance, here's a sliver of how we're thinking of structuring our Terraform scan in a GitHub Action, but I'm unsure if this is the right approach:
```yaml
- name: Snyk Infrastructure as Code Test
uses: snyk/actions/iac@v0.3.0
with:
args: --config-file-path ./prod/aws/terraform.tfvars
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
```
Is the `--config-file-path` even the right way to provide context for dynamic values?
Any insights, especially on scaling this across many repositories and a complex deployment pipeline, would be a huge help. I'm happy to share back our findings as we move forward.
Keep it simple.