Bake Security into your Infrastructure-as-Code

The talk targets teams running workloads in public cloud, hybrid or on-prem environments, not only those already using infrastructure as code. It opens with the case for the approach: provisioning is faster than manual setup, the same code can reproduce production in dev and test, changes are tracked in source control for auditing, and environments can be rebuilt in another region after an attack. It also makes the point that infrastructure code is not secure just because it is code, so the resulting environment has to be verified.

The middle section compares major cloud providers and infrastructure-as-code tools such as Terraform, CloudFormation and Chef. It explains the three kinds of state involved: what is actually deployed, what the code describes, and what the tool records in its state file. The speaker then walks through a CI/CD pipeline with security stages and surveys open-source scanners that catch misconfigurations, using a short GitLab pipeline job to show how little configuration a scan stage needs.

For secrets and governance, the talk introduces the acronym BRUCE: build security gates into the pipeline, remove plaintext passwords, use a secrets server, check commit history for sensitive data, and encrypt secrets. It warns against making manual security fixes outside the code, since that causes drift between the deployed and described states. The closing advice is to practise with free cloud tiers and a tool like Jenkins, avoid assuming infrastructure code is secure, and automate checks wherever possible.