DevSecOps and Software Supply Chain
Infrastructure as Code Review
We identify risky permissions and settings in your Terraform, CloudFormation, Bicep or Kubernetes definitions before the environment is built. Issues are fixed at the source, before being copied into new environments.
What it is
Infrastructure as code (IaC) defines cloud resources and permissions in files. A misconfigured permission in one template is propagated to every environment built from it. The review analyzes these files as code and adds rules that catch risky settings at the pull request stage. It also checks whether state files and variables contain secrets.
Scope
- Terraform, CloudFormation, Bicep, Helm and Kubernetes manifest files
- Overly broad IAM permissions and cross-account trust definitions
- Public storage, broad network rules and unencrypted resources
- Whether Terraform state files and variables contain secrets
- Secure defaults for shared modules and templates
- Policy as code rules that run on the pull request
The need
When organizations need it
- When your cloud environments are built from code instead of the console, and that code is not reviewed for security.
- When preparing a Terraform module or Helm chart to be shared by teams.
- When cloud security scans repeatedly find the same configuration mistakes in each new environment.
Method
How we work
-
Scope
We map infrastructure repositories, modules and which environment is built from which code.
-
Review
We assess permissions, network rules and encryption settings against CIS Benchmarks and your policy.
-
Rules
We convert the risks we find into policy as code rules that catch them at the pull request.
-
Modules
We add secure defaults to shared modules so the issue is addressed at its source.
Outcome
What you have at the end
You have visibility into risky permissions and settings in your infrastructure code, along with the environments they affect. If the same mistake is repeated, it is caught at the pull request before deployment.
Frequently asked questions
How is this different from reviewing the deployed cloud environment?
An environment review shows the current state. An IaC review fixes the source of the mistake, so the same issue does not recur in the next environment.
Do you also find differences between the code and the live environment?
Yes. Changes made in the console that are not reflected in code (drift) are listed separately. These differences can reveal permissions not visible in a code review.
Why do state files matter?
Terraform stores secrets written in the configuration in its state file. When working locally, this file is plain text. Access to the state file can therefore provide more than access to the code itself.
DevSecOps and Software Supply Chain
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting