iac-security

Infrastructure-as-Code Security

Rules (for AI agents)

ALWAYS

• Treat the state file as a secret store. Every value that passes through Terraform — a generated password, an RDS master credential, a private key, the contents of a data source — is written to state in plaintext. sensitive = true only hides a value from CLI output; it changes nothing about what is stored. So read access to the backend is read access to those secrets, and the backend's access policy has to be written on that basis.
• Configure a remote backend with encryption at rest, state locking, and versioning. Prefer the backend's own locking where it exists — recent Terraform supports S3-native locking, so a separate DynamoDB lock table is no longer required for new stacks. references/backends-and-state.md has the per-backend form.
• Pin providers and modules to an exact version or a pessimistic constraint (~> 5.42), and pin a third-party module sourced from a git URL to a commit SHA, not a branch or tag. A module is code that runs with your apply credentials, and a registry or repository you do not control is a supply-chain input like any other.
• Give the apply identity the least privilege that the stack actually needs, and keep it separate from the plan identity. A pipeline role with account-wide admin turns any CI compromise into a full account compromise — cicd-security owns hardening the pipeline itself, iam-best-practices owns the role's shape.
• Encrypt persistent resources by default with a customer-managed key: object storage, block storage, managed databases, queues, log groups. Prefer a module or default that applies it, so a new resource is encrypted because of how the code is organised rather than because someone remembered.
• Deny inbound by default and open ports deliberately. Administrative and database ports reachable from 0.0.0.0/0 are the finding — SSH, RDP, and the managed database ports especially — and "it is only dev" does not change the exposure. references/backends-and-state.md lists the ports worth failing a build over.
• Run plan (or pulumi preview, a CloudFormation change set) in CI, require human approval before applying to production, and run scheduled drift detection that raises an issue when the cloud diverges from the code. Drift is where a break-glass change made at 3am quietly becomes the permanent configuration.
• Scope roles and resource policies with the provider's own condition mechanism — source account, source ARN, organization ID, TLS-only access on storage. iam-best-practices owns policy design; what belongs here is that the condition is expressed in the code rather than clicked into the console.