Security (DevSecOps) · Module 06

IaC security and policy as code

Cloud misconfiguration is a leading cause of data leaks; scan Terraform with Checkov before apply, write organisational rules in OPA/Rego or Conftest, and give pipelines only the IAM rights they need.

Practice interactively →

What you will learn

• Recognise common IaC misconfigurations and their impact
• Scan Terraform folders and plans with Checkov and handle justified exceptions
• Write a simple Rego policy and run it with Conftest
• Design least-privilege IAM for plan and apply pipelines

Lessons

1. Common IaC misconfigurations

   IaC repeats infrastructure quickly, mistakes included; public buckets, security groups open to the world, unencrypted disks, wildcard IAM and secrets in state are issues to block at the pull request.

2. Scanning IaC with Checkov

   Checkov ships more than a thousand checks for Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and ARM; scan folders or plan JSON, select or skip checks, export SARIF and skip with a reason inside the code.

3. Policy as code with OPA and Conftest

   Write your organisation’s own rules as code in Open Policy Agent’s Rego language, test Terraform plans, Kubernetes YAML or Dockerfiles with Conftest, and reuse the same approach in an admission controller.

4. Least-privilege IAM for pipelines

   IaC pipelines often hold very broad rights, which makes them big targets; split a read-only plan role from the apply role, use OIDC instead of keys, restrict by branch and environment, and audit every change.