cloud-security

Assess and harden cloud posture in code

Misconfiguration, not zero-days, is how most cloud breaches start: a public bucket, a wildcard role, SSH open to the internet, or credentials in state. You work in a git worktree and must not touch real cloud accounts, so the unit of work is the infrastructure code in the repo. The host may still hold ambient credentials (~/.aws, gcloud, kubeconfig) that Terraform or a cloud CLI would pick up silently, which is why the commands below are limited to offline ones. Scan the IaC, walk the checklist, fix or report, and prove the fix with an offline check. Baselines: the AWS Well-Architected Security Pillar (identity, detection, infrastructure protection, data protection), CIS Foundations Benchmarks for AWS, Azure and GCP, and the OWASP IaC Security and Secure Cloud Architecture Cheat Sheets. Terraform style belongs to the terraform-patterns skill, an active cloud compromise to the incident-response skill, and behavioural anomalies to the threat-detection skill.

Procedure

1. Scope. Find the branch base: run git merge-base HEAD origin/HEAD (or <default_branch>) and paste the printed SHA as $BASE (the safety hook blocks $(…)). List the infrastructure files the ticket touches: git diff --name-only "$BASE"...HEAD -- '*.tf' '*.tfvars' '*.hcl' '*.yaml' '*.yml' '*.json' '*.bicep'. For an assessment ticket, list all IaC with git ls-files. Call search_lore for approved exceptions, compliance targets (SOC 2, PCI DSS, HIPAA) and the account or landing-zone baseline.
2. Run whatever offline scanners already exist. Never install one.
   • terraform fmt -check -recursive. Run terraform validate only in a root module that is already initialised (.terraform/ exists and .gitignore covers it). Never run terraform init: it downloads providers and modules (remote module sources use the host's ambient credentials) and rewrites .terraform.lock.hcl. If validate cannot run, say so in evidence.
   • checkov -d <dir> --compact --quiet.
   • trivy config <dir>. Trivy replaces tfsec; use tfsec only if the repo still pins it.
   • kics scan -p <dir>.
   • conftest test if the repo has OPA or Rego policies.
   • terraform test only in an already-initialised module whose test files mock every provider (mock_provider): an unmocked run calls the cloud, and the default command = apply creates real resources. Record which scanners ran. If none is available, say so; the manual checklist below then is the evidence. Never run terraform plan, apply or destroy, or any cloud CLI.
3. Walk the checklist against every touched resource (next section). Write "ok" or a finding with file, line and fix.
4. Fix in code, the least-privilege way. Replace a wildcard with the specific actions and ARNs. Add the missing block rather than suppressing the check. A suppression (#checkov:skip=CKV_AWS_20:reason, #trivy:ignore:…) is allowed only when the finding is a genuine documented exception, such as a public CDN origin. The reason goes inline, and you raise a request_decision if no exception is recorded in lore.
5. Prove it. Re-run the same scanners and show the finding gone. Where the repo has mocked terraform test or conftest, add an assertion for the fixed property, for example Block Public Access true or http_tokens == "required", so it cannot regress.
6. Classify and evidence. Use the security-review skill severities.
   • Blocking: exploitable now, for example public data, admin ports open to the internet, a privilege-escalation path, or a plaintext secret.
   • Should-fix: risk without a compensating control.
   • Note: hardening. Record scanner output and findings through the record-evidence skill, then stop.