Infrastructure as Remote Code Execution: How to abuse Terraform to elevate access

The talk introduces Terraform as an infrastructure-as-code tool that keeps a state file describing deployed resources. The speaker argues that this state file and the surrounding pipeline are sensitive targets, because state often holds secrets such as database passwords and receives far less logging and scrutiny than a dedicated secrets manager.

The middle of the talk covers ways someone with pipeline access can go beyond normal deployment. Debug logging can expose temporary cloud credentials in pipeline output. Built-in provisioners such as remote-exec and local-exec can run arbitrary scripts on servers or on the Terraform host, and the external data source can run custom scripts as well. Data sources can also pull sensitive parameters into plans and logs, and the instance metadata service can be queried from the Terraform host. Provider code is a large third-party dependency, and values marked as unknown until apply can hide resources from policy checks written against the plan.

For defenders, the talk recommends pattern-matching rules in Semgrep to block provisioners, policy-as-code checks with Sentinel or OPA, and tightly scoped IAM roles for the pipeline, split by team rather than one shared administrator. It also suggests restricting where the role can be used through IAM conditions, enforcing IMDSv2, reviewing code and modules, and alerting on changes to the pipeline's permissions. The takeaway is that Terraform is valuable for standardizing cloud infrastructure, but it needs least-privilege access and close review of what it executes.