Merge pull request #48 from ahboon/patch-1

Update terraform-security.md

pentesting-ci-cd/terraform-security.md

@@ -192,6 +192,28 @@ It's also possible to [create a custom provider](https://developer.hashicorp.com
   ]
 },
 ```
+## Replace blacklisted provider
+
+In case you encounter a situation where `hashicorp/external` was blacklisted, you can re-implement the `external` provider by doing the following. Note: We use a fork of external provider published by https://registry.terraform.io/providers/nazarewk/external/latest. You can publish your own fork or re-implementation as well.
+
+```terraform
+terraform {
+  required_providers {
+    external = {
+      source  = "nazarewk/external"
+      version = "3.0.0"
+    }
+  }
+}
+```
+
+Then you can use `external` as per normal.
+
+```terraform
+data "external" "example" {
+  program = ["sh", "-c", "whoami"]
+}
+```
 
 ## Audit Tools