Module 3 · Infrastructure-as-Code Security 🔒

Terraform — what to scan for

Categories of Terraform issues:

• Public exposure: S3 buckets with public ACL, security groups 0.0.0.0/0 on sensitive ports, RDS publicly_accessible
• Missing encryption: S3/EBS/RDS unencrypted, secrets in plaintext (Terraform state has them too)
• Logging/monitoring gaps: no CloudTrail, no VPC flow logs, no RDS logs
• IAM: wildcard permissions, overly broad trust policies, no MFA on privileged roles
• Backup/retention: no versioning, missing backup policies, short log retention
• Network: missing VPC endpoints (forcing traffic over internet), public subnets holding data services

Sample Checkov CI job

# .github/workflows/iac-scan.yml
name: IaC Scan
on:
  pull_request:
    paths: ['terraform/**', 'k8s/**', '**/Dockerfile']

jobs:
  checkov:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: bridgecrewio/checkov-action@master
        with:
          directory: .
          framework: terraform,kubernetes,dockerfile
          output_format: sarif
          output_file_path: checkov.sarif
          soft_fail: false       # fail the build on findings
          skip_check: CKV_AWS_79 # specific known-accepted risks
      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: checkov.sarif

Kubernetes — the deeper checklist

Kubernetes manifests have a specific set of security-sensitive fields:

• securityContext.runAsNonRoot — should be true
• securityContext.readOnlyRootFilesystem — should be true
• securityContext.allowPrivilegeEscalation — should be false
• securityContext.capabilities.drop: [“ALL”] — drop then selectively add
• Resource limits and requests — both CPU and memory, always
• No hostNetwork: true, hostPID: true, hostIPC: true except where absolutely required
• ServiceAccount explicitly set (not default); RBAC scoped narrowly
• NetworkPolicy present (without one, pods can talk to every other pod)
• Pod Security Standards: at least baseline, ideally restricted, on every namespace
• Ingress TLS configured; HTTP-only ingresses rejected

Sample Kubernetes manifest — secure defaults

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
  namespace: prod
spec:
  template:
    spec:
      serviceAccountName: api-sa
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
        fsGroup: 10001
        seccompProfile: {type: RuntimeDefault}
      containers:
      - name: api
        image: registry.example.com/api:v1.2.3@sha256:abc...
        securityContext:
          readOnlyRootFilesystem: true
          allowPrivilegeEscalation: false
          capabilities: {drop: [ALL]}
        resources:
          requests: {cpu: 100m, memory: 128Mi}
          limits:   {cpu: 500m, memory: 512Mi}
        ports: [{containerPort: 8080}]

Dockerfile — the scanning layer

Dockerfile-level patterns to catch: