Skip to main content

06 IaC

Infrastructure as Code (IaC) security reference: Terraform, CloudFormation, Pulumi, Helm and Kubernetes manifests as attack surface and as defensive control.

Scope​

This subcategory covers the security of the tools that provision cloud infrastructure:

  • state files and plan artifacts (secret leakage, tampering)
  • provider authentication and CI/CD trust
  • modules, registries and supply chain
  • misconfiguration patterns that produce exploitable infrastructure
  • drift detection and policy as code

It does NOT repeat cloud service attacks (covered in 01 AWS, 02 Azure, 03 GCP) or Kubernetes internals (covered in 04 Kubernetes-Cloud). This is about how the infrastructure is described, generated, and applied.

Files​

#FileFormat
01IaC FundamentalsTwo-track
02State Files and Plan ArtifactsTwo-track
03Modules and Supply ChainTwo-track
04CI/CD and Provider TrustTwo-track
05Misconfiguration Patterns and Policy as CodeTwo-track

Format​

Two-track (Offensive / Defensive). 11 sections:

## 1. Overview
## 2. Reconnaissance / Enumeration
## 3. Common Attack Vectors
## 4. Exploitation Recipes
## 5. Post-Exploitation
## 6. Preventive Controls
## 7. Detection Controls
## 8. Verification
## 9. Certification Alignment
## 10. Production Notes
## 11. References

Certification Alignment​

  • HashiCorp Certified: Terraform Associate
  • AWS Certified DevOps Engineer - Professional
  • AWS Certified Security - Specialty
  • Google Cloud Professional Cloud DevOps Engineer
  • Azure DevOps Engineer Expert (AZ-400)
  • CompTIA Security+
  • 01 AWS
  • 02 Azure
  • 03 GCP
  • 04 Kubernetes-Cloud
  • 05 Serverless
  • DEVSECOPS (planned category, supply chain and CI/CD)

Authorized Use Only​

CAUTION

All techniques in this subcategory are for authorized security testing, CTF environments and educational purposes only. Testing cloud accounts or CI/CD pipelines without written authorization violates the provider terms of service and may be illegal.

References​