Skip to content
Vol. 1 · Ed. 2026
CyberGlossary
日本語
Entry № 593

Infrastructure-as-Code (IaC) Security

Infrastructure-as-Code (IaC) Security とは何ですか?

Infrastructure-as-Code (IaC) SecurityThe discipline of scanning, policy-checking, and securing IaC templates (Terraform, OpenTofu, Pulumi, CloudFormation, Helm, Kubernetes manifests) before they provision misconfigured cloud resources.

Infrastructure-as-Code (IaC) security treats declarative provisioning templates as a primary security artifact: most cloud misconfigurations now originate not from manual console edits but from Terraform, OpenTofu, Pulumi, AWS CloudFormation, Bicep, Helm, or raw Kubernetes manifests committed to a repo and applied by CI. Programs combine static analysis tools (Checkov, KICS, tfsec, Terrascan, Snyk IaC, Trivy config-scan), policy-as-code engines that enforce rules at plan-time (OPA/Rego, Conftest, HashiCorp Sentinel, Checkmarx Cloudguard, Wiz Code), drift-detection comparing live state to source-of-truth, and secret scanners that block hard-coded credentials in `.tf` and `values.yaml`. Increasingly, IaC security extends 'left' into developer workflows (IDE plugins, pre-commit hooks) and 'right' into runtime correlation (proving the deployed S3 bucket matches the reviewed module). Common findings include public S3 buckets, over-broad IAM `*`, missing encryption-at-rest, security groups open to 0.0.0.0/0, and Kubernetes pods running as root.

● 例

  1. 01

    A pull-request CI step runs Checkov against the Terraform plan and blocks a merge that would create an S3 bucket without server-side encryption.

  2. 02

    An OPA policy denies any Kubernetes manifest that mounts the Docker socket or runs with `privileged: true`.

● よくある質問

Infrastructure-as-Code (IaC) Security とは何ですか?

The discipline of scanning, policy-checking, and securing IaC templates (Terraform, OpenTofu, Pulumi, CloudFormation, Helm, Kubernetes manifests) before they provision misconfigured cloud resources. サイバーセキュリティの クラウドセキュリティ カテゴリに属します。

Infrastructure-as-Code (IaC) Security とはどういう意味ですか?

The discipline of scanning, policy-checking, and securing IaC templates (Terraform, OpenTofu, Pulumi, CloudFormation, Helm, Kubernetes manifests) before they provision misconfigured cloud resources.

Infrastructure-as-Code (IaC) Security はどのように機能しますか?

Infrastructure-as-Code (IaC) security treats declarative provisioning templates as a primary security artifact: most cloud misconfigurations now originate not from manual console edits but from Terraform, OpenTofu, Pulumi, AWS CloudFormation, Bicep, Helm, or raw Kubernetes manifests committed to a repo and applied by CI. Programs combine static analysis tools (Checkov, KICS, tfsec, Terrascan, Snyk IaC, Trivy config-scan), policy-as-code engines that enforce rules at plan-time (OPA/Rego, Conftest, HashiCorp Sentinel, Checkmarx Cloudguard, Wiz Code), drift-detection comparing live state to source-of-truth, and secret scanners that block hard-coded credentials in `.tf` and `values.yaml`. Increasingly, IaC security extends 'left' into developer workflows (IDE plugins, pre-commit hooks) and 'right' into runtime correlation (proving the deployed S3 bucket matches the reviewed module). Common findings include public S3 buckets, over-broad IAM `*`, missing encryption-at-rest, security groups open to 0.0.0.0/0, and Kubernetes pods running as root.

Infrastructure-as-Code (IaC) Security からどのように防御しますか?

Infrastructure-as-Code (IaC) Security に対する防御は通常、上記の定義で述べたとおり、技術的統制と運用上の実践を組み合わせます。

Infrastructure-as-Code (IaC) Security の別名は何ですか?

一般的な別名: IaC scanning, Policy-as-Code for IaC, Terraform security。

● 関連用語

● 関連項目