Lighting Talk: Lessons Learned from Writing Thousands of Lines of IaC
summary
Three concrete lessons: the Terraform state file stores cleartext secrets and must be encrypted and access-restricted because leaked state gave away AWS keys; infrastructure drift is common — a single console change turned a limited DNS role into Route53 full access and created a real privilege escalation; reused modules can hide dangerous IAM logic — a public Terraform module granted cross-account access that could let an attacker seize a sandbox. Practical fixes: encrypt state, run drift detection or Git-driven reconciliation, and scan modules with tfsec, Checkov or Validiac.
AI-written summary · about
chapters (5)
- 0:00Intro
- 0:33The State Of The Art
- 2:06Infrastructure Tend to Drift
- 3:36Do Not blindly trust Public Modules
- 5:25Takeaways
related talks
14mLightning Talk: 5 Security Tips for Terraform
01h 00mGotchas using Terraform in a secure delivery pipeline
32mGotchas Using Terraform in a Secure Delivery Pipeline
18mInfrastructure as Code Security Best Practices & Strats
05mUsing Terraform Safely
39mTerraform Practices to Enable Infrastructure Scaling
30mTerraform Practices to Enable Infrastructure Scaling
35mMisadventures with Terraform