Common IaC misconfigurations

IaC repeats infrastructure quickly, mistakes included; public buckets, security groups open to the world, unencrypted disks, wildcard IAM and secrets in state are issues to block at the pull request.

Why misconfiguration is dangerous

Most cloud data incidents come not from software vulnerabilities but from misconfiguration: a public bucket, a database open to the internet, an overly broad role. With IaC, a faulty module used in 30 environments repeats the mistake 30 times. The upside: the mistake lives in code, so it can be scanned before apply.

Typical findings

Area	Terraform example	Impact
Data exposure	`aws_s3_bucket` without a public access block; an Azure storage account allowing public blobs	Anyone can download files
Network	Security group `0.0.0.0/0` to port 22, 3389 or 5432	Brute force, database attacks
Encryption	EBS, RDS or disks without encryption; TLS not enforced	Data exposed from a lost snapshot or eavesdropping
Identity	IAM policy with `"Action": ""`, `"Resource": ""`	One leaked credential takes the whole account
Logging	No CloudTrail, flow logs or access logs	Incidents cannot be investigated
Resilience	No backups, versioning or deletion protection	Data lost to mistakes or ransomware

# Wrong: SSH open to the whole internet
resource "aws_security_group_rule" "ssh" {
  type        = "ingress"
  from_port   = 22
  to_port     = 22
  protocol    = "tcp"
  cidr_blocks = ["0.0.0.0/0"]
}

Fix: restrict it to a VPN range such as 198.51.100.0/24, or drop SSH and use Session Manager.

State and variables are risks too

terraform.tfstate holds real values, including passwords marked sensitive; keep it in an encrypted, access-controlled backend and never commit it.
*.tfvars files holding secrets must stay out of Git.
plan output in CI logs may print sensitive values.

Where to scan

flowchart LR
  IDE["IDE / pre-commit<br/>tflint, checkov"] --> PR["Pull request<br/>checkov, trivy config"]
  PR --> PL["terraform plan<br/>scan plan JSON, OPA"]
  PL --> AP["apply"]
  AP --> RT["Runtime<br/>AWS Config, Azure Policy, CSPM"]

Code scans catch issues early; runtime checks with AWS Config, Azure Policy or a CSPM tool catch manual changes outside IaC (drift).

Traps: trusting that public registry modules are safe; scanning only at release; disabling checks "because it is dev" and then copying the dev module to prod.