Security Engineering
Advanced 17 min read Security Engineering

Infrastructure as Code Security

Your cloud is now source code — so the code must be reviewed, scanned, and diffed: IaC linting (checkov/tfsec), drift, and state-as-a-privilege.

TerraformIaCcheckovtfsecdriftstate filepolicy-as-code
Prerequisites: Cloud Governance DevSecOps Fundamentals
Introduction

What is this?

IaC security means treating your Terraform/CloudFormation/Ansible as the security boundary: static checks on the code, reviewed diffs, protected state, and drift detection that proves reality matches intent.

Motivation

Why do you need it?

  • The plan file is the config; an insecure plan deploys an insecure cloud no matter how good the runtime canaries are.
  • Unreviewed IaC diffs ship misconfigurations at terraform speed — the exact speed of modern incidents.
  • The state file is effectively an access map; it needs its own protection, not just the code.
Think about it

Mental model

Imagine

A building's blueprints

Think of

Blueprints built from memory and changed by email

The building is only as safe as the current, reviewed blueprint — not the one someone 'kept in their head'.

Mechanics

How it works

  • Linters scan HCL/CFN/YAML for problematic patterns: public buckets, open security groups, missing encryption.
  • Plan diffs go through normal code review: as a human merge gate plus automated static checks.
  • Drift detection compares live state to the declared config and alerts on divergence.
  • State files are encrypted, versioned, and access-controlled — they enumerate the whole environment.

IaC security in the loop

Code
Lint
Plan
Apply
Verify
Real world

In production

  • A platform team's CI fails a plan that opens a security group to 0.0.0.0/0; a reviewer must sign the exception.
  • An org makes the state bucket lockable and versioned so a misapplied plan can be rolled back.
  • A bank scans every PR's IaC with checkov and sees its 'open ports' class shrink to zero in a quarter.
Guidelines

Best practices

  • Run IaC scanners on every PR with severity gates, like any static analysis.
  • Review plan diffs in code review, and tie producers' environments to golden modules.
  • Encrypt and lock state; put secrets in a vault, never in plan output or the state diff.
  • Alert on drift and run periodic reconcilers for the highest-risk resources.
Watch out

Common mistakes

  • Scanning the IaC in the repo but never detecting live drift, so reality and code diverge silently.
  • Storing the state file plaintext on a shared bucket — the address book of your infra.
  • Slopping a secret into an output block that lands in the plan log.
  • Treating 'terraform output shows secure' as evidence without a live check.
When things break

Debugging tips

  • When live differs from the plan, run a plan --refresh and diff — that's your real drift report.
  • For a scanner false positive, cross-check the resource's effective policy, not just the code line.
  • Keep state lock/serial numbers in CI logs so concurrent applies can't clobber each other.
Security

Security considerations

  • State is sensitive data: classify it, rotate its access, and never print it in CI logs.
  • Golden modules reduce variability — but a flaw in the golden module is replicated everywhere; review the module itself as the crown jewel.
Interviews

Interview checkpoint

Practice

Hands-on lab

Lint an IaC Snippet and Prove Drift Reacts
45 min · advanced
In progress
Objectives
  • Write a small Terraform-ish snippet with a misconfig.
  • Scan it with checkov and fix the finding.
  • Model a drift check comparing declared vs observed.

Lint an IaC Snippet and Prove Drift Reacts

45 min · advanced

0/4 steps
0%
sandbox · Linux sandbox
$
Try these commands
Test yourself

Quick quiz

0/2
1

The state file warrants protection because...

2

Drift means...

Go deeper

Official documentation

Checkov docs
docs
Terraform best practices (security)
docs