Skip to content
Vol. 1 · Ed. 2026
CyberGlossary
Русский
Entry № 593

Infrastructure-as-Code (IaC) Security

Что такое Infrastructure-as-Code (IaC) Security?

Infrastructure-as-Code (IaC) SecurityThe discipline of scanning, policy-checking, and securing IaC templates (Terraform, OpenTofu, Pulumi, CloudFormation, Helm, Kubernetes manifests) before they provision misconfigured cloud resources.

Infrastructure-as-Code (IaC) security treats declarative provisioning templates as a primary security artifact: most cloud misconfigurations now originate not from manual console edits but from Terraform, OpenTofu, Pulumi, AWS CloudFormation, Bicep, Helm, or raw Kubernetes manifests committed to a repo and applied by CI. Programs combine static analysis tools (Checkov, KICS, tfsec, Terrascan, Snyk IaC, Trivy config-scan), policy-as-code engines that enforce rules at plan-time (OPA/Rego, Conftest, HashiCorp Sentinel, Checkmarx Cloudguard, Wiz Code), drift-detection comparing live state to source-of-truth, and secret scanners that block hard-coded credentials in `.tf` and `values.yaml`. Increasingly, IaC security extends 'left' into developer workflows (IDE plugins, pre-commit hooks) and 'right' into runtime correlation (proving the deployed S3 bucket matches the reviewed module). Common findings include public S3 buckets, over-broad IAM `*`, missing encryption-at-rest, security groups open to 0.0.0.0/0, and Kubernetes pods running as root.

● Примеры

  1. 01

    A pull-request CI step runs Checkov against the Terraform plan and blocks a merge that would create an S3 bucket without server-side encryption.

  2. 02

    An OPA policy denies any Kubernetes manifest that mounts the Docker socket or runs with `privileged: true`.

● Частые вопросы

Что такое Infrastructure-as-Code (IaC) Security?

The discipline of scanning, policy-checking, and securing IaC templates (Terraform, OpenTofu, Pulumi, CloudFormation, Helm, Kubernetes manifests) before they provision misconfigured cloud resources. Относится к категории Облачная безопасность в кибербезопасности.

Что означает Infrastructure-as-Code (IaC) Security?

The discipline of scanning, policy-checking, and securing IaC templates (Terraform, OpenTofu, Pulumi, CloudFormation, Helm, Kubernetes manifests) before they provision misconfigured cloud resources.

Как работает Infrastructure-as-Code (IaC) Security?

Infrastructure-as-Code (IaC) security treats declarative provisioning templates as a primary security artifact: most cloud misconfigurations now originate not from manual console edits but from Terraform, OpenTofu, Pulumi, AWS CloudFormation, Bicep, Helm, or raw Kubernetes manifests committed to a repo and applied by CI. Programs combine static analysis tools (Checkov, KICS, tfsec, Terrascan, Snyk IaC, Trivy config-scan), policy-as-code engines that enforce rules at plan-time (OPA/Rego, Conftest, HashiCorp Sentinel, Checkmarx Cloudguard, Wiz Code), drift-detection comparing live state to source-of-truth, and secret scanners that block hard-coded credentials in `.tf` and `values.yaml`. Increasingly, IaC security extends 'left' into developer workflows (IDE plugins, pre-commit hooks) and 'right' into runtime correlation (proving the deployed S3 bucket matches the reviewed module). Common findings include public S3 buckets, over-broad IAM `*`, missing encryption-at-rest, security groups open to 0.0.0.0/0, and Kubernetes pods running as root.

Как защититься от Infrastructure-as-Code (IaC) Security?

Защита от Infrastructure-as-Code (IaC) Security обычно сочетает технические меры и операционные практики, как описано в определении выше.

Какие есть другие названия Infrastructure-as-Code (IaC) Security?

Распространённые альтернативные названия: IaC scanning, Policy-as-Code for IaC, Terraform security.

● Связанные термины

● См. также