Apisecure, 14 & 15 March 2023 - Mike McCabe, President at Cloud Security Partners.
summary
Shows how Terraform features let an attacker escalate from CI/CD to cloud: examples include remote-exec/netcat shell to get host access, local-exec or data sources calling EC2 metadata to leak STS creds, and secrets embedded in terraform state and provider code. Describes writing thousands of policy rules across AWS/GCP/Azure, integrating semgrep pre-plan and HashiCorp Sentinel (or OPA) for plan-time checks, and a case where infra-as-code enforcement produced zero CSPM findings for a large client.
AI-written summary · about
chapters (26)
- 0:00Introduction
- 0:24Infrastructure as code
- 1:48Terraform benefits
- 4:37Terraform security challenges
- 8:29How Terraform works
- 11:17Terraform state risks
- 14:51Protecting state files
- 17:17Terraform providers risks
- 19:45Terraform APIs access
- 21:30Threat model for Terraform
- 22:12Remote code execution in Terraform
- 26:05Prevent remote execution misuse
- 29:35Semgrep security checks
- 32:01Terraform data gathering risks
- 35:17Advanced semgrep rules
- 37:27Pattern matching limits
- 38:31Sentinel and OPA enforcement
- 41:17Plan vs post-apply checks
- 44:09Multi-layered security
- 45:14Identity and access management controls
- 46:40Infrastructure patterns
- 47:43Hardening services and IAM
- 48:26Automated code reviews
- 48:46Monitoring Terraform
- 49:30Takeaways
- 50:12Q&A
related talks
29mShifting Terraform Configuration Security Left
22mSecurity vs Dev Experience Threat … or Opportunity
20mSentinel in action: Policy as code for secure Terraform workflows in HCP
40mHashiConf Day 1 Opening Keynote
01h 00mGotchas using Terraform in a secure delivery pipeline
14mLightning Talk: 5 Security Tips for Terraform
45mCatching Commits to Secure Infrastructure as Code
47mBreaking the Cloud to Rebuild It: A Tale of 3 ☁️ Breaches!