Introduction
- Who this book is for
- Who this book is not for
- How to use this book
- Prerequisites
Chapter 1 — Why Security Engineers Can’t Ignore IaC
- The attack surface moved into the repo
- Why this is your problem specifically
- What this book will and won’t do
Chapter 2 — Reading Terraform Like an Auditor, Not a Builder
- The five things you need to recognize
- The plan is where the truth lives
- What you don’t need
Chapter 3 — Where Secrets Leak
- The hardcoded credential, and why it never really leaves
- Where secrets hide when they’re not “hardcoded”
- Provider credential scope: the leak that matters most
- Detecting what’s already leaked
- What this means for your review
Chapter 4 — The State File as a Liability
- Why the state file knows more than the code does
- Where state lives, and why that choice is a security decision
- What a stolen state file actually gives an attacker
- Drift as a security signal, not just a correctness problem
- What to check, in practice
Chapter 5 — Threat-Modeling the Pipeline
- An identity that never sleeps and never asks questions
- The access control layer moved to the merge button
- Compromise scenario: the poisoned pull request
- Compromise scenario: the runner itself
- Compromise scenario: the leaked pipeline token
- Mapping the pipeline to a threat model an auditor recognizes
Chapter 6 — Policy as Code: What It Can and Can’t Guarantee
- The landscape, briefly
- The failure mode: “the scanner passed”
- Reading a policy for what it actually enforces
- What good coverage looks like
Chapter 7 — Supply-Chain Risk in Modules and Providers
- What a module call actually commits you to
- Pinning is necessary and not sufficient
- Vetting a module before it gets copied a thousand times
- Providers: a different, sharper risk
- Dependency confusion and typosquatting, in IaC terms
- What to check, in practice
Chapter 8 — Reviewing a Terraform Plan Under Deadline
- The checklist
- Worked example
- What to demand, what to refuse
- Why this order works under pressure
Chapter 9 — Turning Review Into Evidence
- The audit trail you already have, if you use it
- Mapping what you’re already doing to what auditors ask for
- Documentation an auditor will actually accept
- From one review to a repeatable program
Appendix — Checklists, Commands, and References
- The under-deadline review checklist (Chapter 8)
- Secrets review checklist (Chapter 3)
- State file checklist (Chapter 4)
- Pipeline threat model (Chapter 5)
- Policy-as-code coverage checklist (Chapter 6)
- Supply-chain checklist (Chapter 7)
- Tool reference
- Core questions to carry into any review