Infrastructure as Code Security Best Practices & Strats
summary
Covers concrete IaC practices: use terraform or similar, enforce IAM role with admin avoidance and fine-grained tags, store secrets outside code, and keep templates updated for AWS Azure and GCP. Demonstrates a real failure mode—an accidentally public S3 bucket leaking sensitive dumps—and attack paths from container escape to privilege escalation. Recommends git versioning, CI pipelines that run automated scanners but warns of a poisoned pipeline that executes malicious templates, and shows protecting resources from accidental deletion.
AI-written summary · about
chapters (14)
- 0:00intro
- 1:43preamble
- 1:54about joshua
- 2:31let's begin
- 6:22tag resources properly
- 7:05avoid insecure defaults and regurarly check for announcements in cloud platforms
- 8:51secret management & permission management
- 10:17why?
- 12:43track and manage changes using version control tools
- 15:05use pipelines to analyze security vulnerabilities automatically
- 15:30be careful when managing resources with iac in pipelines!
- 16:40poisoned pipeline execution
- 17:10protect specific resources from accidental deletion or modification
- 18:02the end
related talks
15mInfrastructure as a Code: Best Practices and Myths
36mInfrastructure as Code Done Right: Discovering and Fixing Common Missteps
08mLighting Talk: Lessons Learned from Writing Thousands of Lines of IaC
48mWhy checking your infrastructure-as-code for misconfigurations is not enough – How ...
22mOur Journey to Shift-left Security with Infrastructure as Code
19mFrom Code to Cloud: Embedding Security
40mSecurity-as-Code to Accelerate DevSecOps, a Practical Guide to Get Started
29mPragmatic Security Automation and DevSecOps in the Cloud