Infrastructure as Code (IaC) Security

What it is

When infrastructure is code (Terraform, CloudFormation, K8s manifests), misconfigurations are checked into the same repo — which is good: they can be scanned and blocked before apply.

Why it matters

Misconfiguration is a top initial-access cause in the cloud (see security:misconfiguration). IaC lets you catch these as a software defect rather than discovering them live in production.

How it works

• Scan templates/manifests for insecure defaults (world-open buckets, unrestricted egress, over-permissive IAM).
• Enforce policy-as-code (OPA/sentinel) gates in CI so risky changes never deploy.
• Never store secrets in IaC/source; reference a secrets manager (see security:secrets-management).
• Validate real state against declared state to catch drift.

Detection

• Policy/scan finding on a new PR (e.g., public S3 bucket, wildcard IAM).
• Drift where live resource permissions exceed the declared manifest.

Mitigation

• Add IaC scanning and policy gates to the pipeline (see security:devsecops).
• Apply least-privilege IAM by default; eliminate wildcard grants.
• Rotate any secret that appears in source history immediately.

Investigation

If a cloud resource was exposed via misconfiguration, trace the IaC commit that introduced it, the policy gate that should have blocked it, and any access logs to scope exposure. See security:cloud-native-security.