Infrastructure as code security

Modern cloud estates are described in code: templates written in Terraform, CloudFormation or similar declare the resources, their settings and their permissions, and applying the template creates or updates the real infrastructure. Infrastructure as code security scans those templates for problems the same way static analysis scans application code: an open security group, an over-broad role, an unencrypted store, a secret hard-coded into a variable. Because the template is the source of truth, a fix made there is applied everywhere the template is used and stays fixed on the next deployment, rather than being a one-off change in a console that drifts back. The state file the tooling produces is itself sensitive and needs protecting.

Fixing cloud misconfigurations only in the console is a treadmill: the next apply of the template reverts the change, and the cloud misconfiguration returns. The deeper problem we find is templates that carry secrets or grant excessive permissions by default, replicated across every environment they build. From an attacker’s side, two prizes recur: a secret committed into the template or its variables, and an exposed state file, since a Terraform state file records the resources and often the sensitive values used to build them, so state exposure can hand over credentials directly. The template is code, and it is treated with less scrutiny than the application it stands up.

We review the templates and the pipeline that applies them: hard-coded secrets, over-broad permissions, insecure defaults, and how the state is stored and who can read it. Findings are written against the template line that causes them, so the fix lands where it persists, and we cross-check against what a posture management tool sees at runtime. Secret handling is pushed towards proper secrets management. This is part of how we review infrastructure templates and their secrets.