auditing-infrastructure-as-code-exposures

Auditing infrastructure-as-code exposures: what the definition would actually provision

Infrastructure-as-code is desired state, so the bug is not what a line says but what the resource becomes once variables resolve, modules compose, and account defaults apply. A bucket ACL that reads public may be overridden by an account block, and a security group open to the internet may sit in a private subnet nothing routes to. This audit reads the definition and asks one question per resource: once applied, does this provision a resource that violates its security baseline, least exposure, encryption on, least privilege, logging on, no plaintext secret. Everyone has the checklist; the work that matters is adjudicating the effective config and killing the finding that a different layer already neutralizes. Anchor on auditing what exists, not generating or refactoring it.

When to use

• You have Terraform, OpenTofu, CloudFormation, Bicep, or Pulumi definitions for infrastructure in scope.
• A resource block declares storage, a network rule, an identity or resource policy, encryption, or logging.
• You want to know which blocks would provision an insecure resource once applied, not just which lines look wrong.

Scope check

Audit only definitions for infrastructure you own or are authorized to assess, and never apply a definition or mutate a live account to test a finding, adjudicate on the resolved config, not by provisioning. If you can't name the authorization, stop.

The loop

1. Resolve the effective config first. For each resource, follow the variables, locals, modules, and any tfvars, parameter files, or workspace overrides that feed its arguments, and factor in account or region defaults (default encryption, a block-public-access setting, an org policy). The literal in the module is not what deploys; the resolved state is. Settle it before judging any field.

2. Check storage exposure. Look for a bucket or object ACL of public-read or public-read-write, a bucket or resource policy with a wildcard principal, or block-public-access disabled, then confirm no account-level block or explicit deny overrides it. Public storage is the effective policy, not the ACL.