Internship
Student login
← Cloud Security learning path
Cloud Security · Module 7 of 10

Infrastructure as code security

Build secure infrastructure from code.

📖 Key ideas

  1. Define infrastructure with Terraform, CloudFormation or Bicep.
  2. Review IaC changes in pull requests.
  3. Scan IaC with Checkov, tfsec/Trivy before deployment.
  4. Policy as code (OPA, Sentinel) blocks non-compliant changes.
  5. Detect drift between code and live resources.
💡 Real-life example: Secure IaC is approving a building blueprint before construction, not inspecting after it's built.
IaCInfrastructure as Code
CheckovIaC security scanner
Policy as codeAutomated compliance rules
DriftLive resources differing from code