Infrastructure-as-Code (IaC) Security
Was ist Infrastructure-as-Code (IaC) Security?
Infrastructure-as-Code (IaC) SecurityThe discipline of scanning, policy-checking, and securing IaC templates (Terraform, OpenTofu, Pulumi, CloudFormation, Helm, Kubernetes manifests) before they provision misconfigured cloud resources.
Infrastructure-as-Code (IaC) security treats declarative provisioning templates as a primary security artifact: most cloud misconfigurations now originate not from manual console edits but from Terraform, OpenTofu, Pulumi, AWS CloudFormation, Bicep, Helm, or raw Kubernetes manifests committed to a repo and applied by CI. Programs combine static analysis tools (Checkov, KICS, tfsec, Terrascan, Snyk IaC, Trivy config-scan), policy-as-code engines that enforce rules at plan-time (OPA/Rego, Conftest, HashiCorp Sentinel, Checkmarx Cloudguard, Wiz Code), drift-detection comparing live state to source-of-truth, and secret scanners that block hard-coded credentials in `.tf` and `values.yaml`. Increasingly, IaC security extends 'left' into developer workflows (IDE plugins, pre-commit hooks) and 'right' into runtime correlation (proving the deployed S3 bucket matches the reviewed module). Common findings include public S3 buckets, over-broad IAM `*`, missing encryption-at-rest, security groups open to 0.0.0.0/0, and Kubernetes pods running as root.
● Beispiele
- 01
A pull-request CI step runs Checkov against the Terraform plan and blocks a merge that would create an S3 bucket without server-side encryption.
- 02
An OPA policy denies any Kubernetes manifest that mounts the Docker socket or runs with `privileged: true`.
● Häufige Fragen
Was ist Infrastructure-as-Code (IaC) Security?
The discipline of scanning, policy-checking, and securing IaC templates (Terraform, OpenTofu, Pulumi, CloudFormation, Helm, Kubernetes manifests) before they provision misconfigured cloud resources. Es gehört zur Kategorie Cloud-Sicherheit der Cybersicherheit.
Was bedeutet Infrastructure-as-Code (IaC) Security?
The discipline of scanning, policy-checking, and securing IaC templates (Terraform, OpenTofu, Pulumi, CloudFormation, Helm, Kubernetes manifests) before they provision misconfigured cloud resources.
Wie funktioniert Infrastructure-as-Code (IaC) Security?
Infrastructure-as-Code (IaC) security treats declarative provisioning templates as a primary security artifact: most cloud misconfigurations now originate not from manual console edits but from Terraform, OpenTofu, Pulumi, AWS CloudFormation, Bicep, Helm, or raw Kubernetes manifests committed to a repo and applied by CI. Programs combine static analysis tools (Checkov, KICS, tfsec, Terrascan, Snyk IaC, Trivy config-scan), policy-as-code engines that enforce rules at plan-time (OPA/Rego, Conftest, HashiCorp Sentinel, Checkmarx Cloudguard, Wiz Code), drift-detection comparing live state to source-of-truth, and secret scanners that block hard-coded credentials in `.tf` and `values.yaml`. Increasingly, IaC security extends 'left' into developer workflows (IDE plugins, pre-commit hooks) and 'right' into runtime correlation (proving the deployed S3 bucket matches the reviewed module). Common findings include public S3 buckets, over-broad IAM `*`, missing encryption-at-rest, security groups open to 0.0.0.0/0, and Kubernetes pods running as root.
Wie schützt man sich gegen Infrastructure-as-Code (IaC) Security?
Schutzmaßnahmen gegen Infrastructure-as-Code (IaC) Security kombinieren typischerweise technische Kontrollen und operative Praktiken, wie in der Definition oben beschrieben.
Welche anderen Bezeichnungen gibt es für Infrastructure-as-Code (IaC) Security?
Übliche alternative Bezeichnungen: IaC scanning, Policy-as-Code for IaC, Terraform security.
● Verwandte Begriffe
- cloud-security№ 209
Cloud-Fehlkonfiguration
Sicherheitslücke durch falsche oder unsichere Einstellungen von Cloud-Diensten, etwa offene Speicher, schwache IAM-Richtlinien oder freigegebene Management-Ports.
- cloud-security№ 280
CSPM (Cloud Security Posture Management)
Kategorie von Werkzeugen, die Cloud-Konten kontinuierlich gegen Best-Practice- und Compliance-Baselines prüfen, um Fehlkonfigurationen zu erkennen und zu beheben.
- cloud-security№ 939
Policy as Code
Praxis, Sicherheits-, Compliance- und Governance-Regeln in maschinenlesbarem Code zu definieren, sodass sie versioniert, getestet, reviewt und automatisch durchgesetzt werden.
- cloud-security№ 848
OPA (Open Policy Agent)
CNCF-graduierte, universelle Policy-Engine, die mit der Rego-Sprache Autorisierungsentscheidungen von Anwendungen und Kubernetes-Admission entkoppelt.
- cloud-security№ 1103
Security as Code
Praxis, Sicherheitskontrollen, Tests und Infrastruktur als Quellcode auszudrücken, sodass sie versioniert, peer-reviewt, automatisiert und kontinuierlich mit Apps ausgeliefert werden.
- appsec№ 1145
Shift-Left-Security
Praxis, Sicherheitsaktivitäten früher im Software-Lebenszyklus zu verankern, damit Schwachstellen gefunden und behoben werden, bevor Code in Produktion geht.