Securing Your Infrastructure as Code Pipeline
summary
Centralize IaC execution into a single reconciler and only allow vetted OCI-wrapped modules: Jenkins produces Terraform modules as OCI images, runs checkoff to emit a CycloneDX SBOM, uses cosign + Fulcio + Rekor to sign images and attach attestations, and stores attestations in ArcaVista via witness/in-toto so SBOMs cannot be spoofed. Crossplane package manager already verifies signatures; Flux TF controller can pull signed module images but currently fails private Rekor verification so a Kyverno/admission or upstream TF-controller fix is required to make the pipeline fully enforceable.
AI-written summary · about
chapters (17)
- 0:00Securing IaC pipelines
- 1:04IaC is software
- 2:06Defining infrastructure as code
- 3:11Supply chain risks in IaC
- 3:32Autodesk's IaC journey
- 4:56Threats in CI/CD for IaC
- 6:18Walled garden for IaC deps
- 7:20Centralizing IaC reconciliation
- 8:25Static analysis limits
- 9:07TF controller with OCI registries
- 10:32Demo: secure IaC pipeline
- 16:36Signature verification gaps
- 17:38Admission controllers
- 18:41Verifying attestations with Witness
- 20:25Storing attestations in ARCA Vista
- 26:05Securing IaC principles
- 27:50Future directions & Q&A
related talks
15mEnforcing a Secure Supply Chain on Kubernetes
26mProtect the Pipe! A Policy-based Approach for Securing CI/CD Pipe...
10mIt's Time We Start Securing Our CICD Pipelines
35mSecuring the Perimeter - CFCR/CFAR Chain of Custody With CI/CD Pipelines
35mEnforcing a Secure Supply Chain on Kubernetes
35mOne Pipeline, Three Regulator - SBOM Compliance for the Developer
20mTrust but Verify
48mSecuring Your Pipes with a TACO