DevSecOps Practice Hub

Infrastructure as Code Security

Analyse Terraform, Kubernetes manifests, Helm charts and CloudFormation for insecure configuration before apply.

IntermediateInfrastructure as Code SecurityInfrastructureCloud

Where it fits in the lifecycle

  1. Plan
  2. Code
  3. Build
  4. Test
  5. Release
  6. Deploy
  7. Operate
  8. Monitor
  • Code Static analysis, secret detection and secure coding practices.
  • Build Dependency scanning, image scanning, SBOM generation and signing.

Overview

Infrastructure defined as code can be reviewed like code. IaC scanners evaluate resource definitions against policy — public storage, unencrypted volumes, permissive security groups, missing logging — before anything is provisioned.

Why it matters

Cloud misconfiguration is a leading cause of exposure. Catching it in the merge request avoids remediating live infrastructure under pressure.

How it works

  1. 01Templates or plan output are parsed into a resource graph.
  2. 02Built-in and custom policies evaluate each resource and its relationships.
  3. 03Results are reported with the file, resource address and remediation guidance.
  4. 04Scanning the plan file catches values resolved only at apply time.

Common tools

CheckovtfsecKICSTerrascanTerraformKubernetesAWSAzure

Implementation examples

bashScan a Terraform directory
checkov -d . --framework terraform --compact
Static scan of the templates in the repository.
bashScan the plan for resolved values
terraform plan -out tfplan.binaryterraform show -json tfplan.binary > tfplan.jsoncheckov -f tfplan.json
Plan-based scanning sees interpolated variables and module outputs that template scanning misses.

Security considerations

  • Plan JSON can contain sensitive values; do not publish it as a public artefact.

Best practices

  • Scan both templates and plan output.
  • Write custom policies for organisation-specific rules such as required tags.
  • Keep suppressions inline with a justification comment and an owner.

Common mistakes

  • Only scanning templates and missing runtime-resolved configuration.
  • Allowing broad blanket skips at the repository level.

Hands-on labs