Infrastructure as Code Done Right: Discovering and Fixing Common Missteps
summary
Cloud infrastructure code suffers from real, measurable mistakes: Sonar telemetry finds 1,500,000 hardcoded keys in IaC files, common misconfigurations expose S3 buckets, and Copilot-generated manifests contain multiple errors because AI is correct about 29% of the time. Fixes are concrete: run linters in the IDE and pre-commit hooks, enforce quality gates in CI (Sonar, GitHub + Argo CD), use parameterization and least-privilege IAM, test with ephemeral environments like LocalStack, sign commits, and split large manifests into reusable modules.
AI-written summary · about
chapters (25)
- 0:00Introduction and setup
- 1:51Speaker introduction
- 4:21What is Sonar and its tools
- 6:29Agenda and IaC overview
- 8:16Properties of IaC
- 10:03Benefits of IaC
- 11:28Common IaC problems
- 14:42Real-world IaC failures
- 16:04Misconfigurations in IaC
- 17:29Hardcoded secrets risks
- 18:13Inconsistent tooling issues
- 19:17Best practices for IaC
- 21:30Modular design and testing
- 22:33Security and observability
- 25:03Sonar’s IaC findings
- 26:10Key IaC rules and fixes
- 27:40Permission and wildcard risks
- 28:42Logging and exclusion pitfalls
- 29:28AI-generated IaC reliability
- 30:56AI experiment with Quarkus
- 32:41AI tools comparison
- 33:03Tooling recommendations
- 34:06Testing IaC with ephemeral environments
- 35:09SonarCube quality gates
- 35:31Summary and Q&A
related talks
18mInfrastructure as Code Security Best Practices & Strats
42mInfrastructure as Code - Lessons learned from Dev to Ops
15mInfrastructure as a Code: Best Practices and Myths
32mCode Quality and Infrastructure as Code
21mPitfalls of Infrastructure as Code (And how to avoid them!)
48mWhy checking your infrastructure-as-code for misconfigurations is not enough – How ...
54mInfrastructure as code (anti) Patterns
46mImplementing Infrastructure as Code