Skip to content
sec/atlas
back to the map
technique
stage: definir
2 min read

Secure infrastructure as code

When infrastructure is code, its security can be code too: reviewed in a PR, scanned before apply and compared with reality to catch what changed out of band.

TerraformCheckovTrivyAnsible

What it is

(IaC) describes networks, identities, databases and permissions in versioned files instead of console clicks. For security this changes the game: configuration gains history, peer review, tests and the same pipeline as software.

The flip side is that a mistake in the code is replicated at scale: one module with a public bucket creates a hundred public buckets. That is why IaC must be treated as sensitive code, with its own controls.

Scan before apply

Static analysis tools for IaC read the files (or the Terraform plan) and flag insecure configurations before any resource exists: security groups open to the world, unencrypted storage, policies with wildcards. It is for infrastructure, and the same shift-left principle applies.

main.tf - problem and fixhcl
# problem: SSH open to the internet
resource "aws_security_group_rule" "ssh_bad" {
  type              = "ingress"
  from_port         = 22
  to_port           = 22
  protocol          = "tcp"
  cidr_blocks       = ["0.0.0.0/0"]   # <- scanner flags this
  security_group_id = aws_security_group.app.id
}

# fix: only the admin network
resource "aws_security_group_rule" "ssh_ok" {
  type              = "ingress"
  from_port         = 22
  to_port           = 22
  protocol          = "tcp"
  cidr_blocks       = [var.admin_cidr]
  security_group_id = aws_security_group.app.id
}

Terraform state is sensitive

The state file records what Terraform created, and that can include plaintext secrets (generated passwords, keys). It must not go into the repository. Use an encrypted remote backend with strict access control and concurrency locking, and give the pipeline only the permissions the plan actually needs.

backend.tfhcl
terraform {
  backend "s3" {
    bucket         = "minha-org-tfstate"
    key            = "prod/network.tfstate"
    region         = "us-east-1"
    encrypt        = true
    dynamodb_table = "tfstate-lock"   # lock against simultaneous apply
  }
}

Drift: what changed out of band

Someone changes a resource in the console during an incident and forgets to revert it. The real state diverges from the code (drift), and the code stops being the truth. Running a periodic plan, or drift detection tools, turns that divergence into an alert, and cloud posture management () looks at the same problem from the environment side.

Approved modules

  • Internal modules with secure defaults built in (encryption, logs, owner tags): the secure path becomes the easy path.
  • Pinned versions of modules and providers, with review to update them.
  • Least-privilege permissions for the identity that runs apply, separated by environment.
  • Mandatory review and the plan attached to the PR so the reviewer sees the real effect.
IaCinfrastructure as codeDescribing infrastructure in versioned files (Terraform, Ansible). It brings review, history and testing to configuration, but replicates mistakes at scale if it is not scanned.see in glossary →SASTStatic analysis: examines the code without running it. It finds issues through flow analysis, not guesswork.see in glossary →CSPMcloud security posture managementA tool that scans your cloud configuration against best practices and benchmarks (CIS, NIST), flagging public S3 buckets, overly broad IAM, exposed ports. It asks the question humans forget: 'what is misconfigured RIGHT NOW?'.see in glossary →

connections on the map

updated on 14/10/2026 · sources to go deeper · report an error

in other domains

Study before

Unlocks

test what you learned

Loading questions…