Infrastructure as Code (IaC) Security
Relevant source files
The following files were used as context for generating this wiki page:
Infrastructure as Code (IaC) Security in Fixops encompasses the automated scanning, validation, and hardening of cloud infrastructure definitions, primarily focusing on Terraform and Kubernetes manifests. The system identifies misconfigurations such as insecure state storage, exposed credentials, and lack of network protections before infrastructure is deployed to production environments.
Sources: reviews/review_security_v1.yaml:35-40, web/aggregate-out/triage/index.html
Core IaC Hardening Controls
The project identifies several critical areas for IaC hardening, specifically focusing on cloud provider state management and network ingress security.
Terraform State Management
Security reviews indicate that the default Terraform backend configuration stores state in generic S3 buckets (e.g., bank-terraform-state), which creates risks of state collisions across tenants and unauthorized access if encryption is not explicitly enforced. Recommendations include using dedicated, encrypted state buckets per environment with unique prefixes.
Sources: reviews/review_security_v1.yaml:35-40, reviews/review_consolidated_v1.yaml:35-40
Ingress and Edge Protection
Infrastructure definitions for Kubernetes ingress often expose public hosts without Web Application Firewall (WAF) or rate-limiting annotations. Hardening requirements include:
- Applying WAF/IPS annotations to all public-facing services.
- Enforcing mutual TLS (mTLS) or private ingress for sensitive internal components.
- Restricting host mappings to explicit, vetted domains.
Sources: reviews/review_security_v1.yaml:35-40, reviews/review_consolidated_v1.yaml:35-40
IaC Automation and Scaffolding
Fixops utilizes Backstage templates to automate the generation of secure-by-default infrastructure manifests for both Kubernetes and Terraform.
Kubernetes Scaffolder Flow
The system provides templates to deploy the Fixops Decision Engine to various Kubernetes distributions. This automation includes the creation of namespaces, persistent volume claims (PVCs) for the Evidence Lake, and the configuration of secrets.
This diagram represents the sequence of steps defined in the Backstage template for deploying Kubernetes infrastructure.
Sources: deployment-packs/kubernetes/backstage/template.yaml:100-180
Terraform Module Architecture
For enterprise deployments, the system generates Terraform configurations that define the entire security platform stack.
| Module | Description | Security Features |
|---|---|---|
fixops_namespace | K8s Namespace | Network policies, Restricted Pod Security Standards. |
fixops_storage | Evidence Lake | Encrypted SSD, 7-year retention for compliance. |
fixops_mongodb | Database | Auth enabled, TLS enabled, Replica set for HA. |
fixops_ingress | Access Layer | TLS enabled, Security headers, Bank CA issuer. |
Sources: archive/enterprise_legacy/backstage/template.yaml:130-250
Security Architecture Zoning
The IaC definitions follow a tiered network zoning pattern to isolate components based on their exposure and data sensitivity.
Zoning architecture enforced by IaC security groups and network policies to ensure least privilege connectivity.
Sources: demo_ssdlc_stages/02_design_architecture.yaml:40-55
Identified IaC Vulnerabilities
The Fixops triage system captures and prioritizes vulnerabilities discovered within IaC files during the SSDLC process.
Common Findings
- Exposed Credentials: AWS Access Keys or secrets found in
terraform/main.tforrbac/secret.yaml. - RBAC Misconfiguration: Over-privileged service accounts or cluster roles found in Kubernetes manifests.
- Unencrypted Connections: Database connections (e.g., RDS) defined without SSL/TLS requirements in Terraform.
- Public S3 Buckets: Infrastructure definitions lacking
public_access_blockconfigurations.
Sources: web/aggregate-out/triage/index.html, reviews/review_consolidated_v1.yaml:105-115
Risk Scoring for IaC
The system calculates a risk score (0-100) for IaC findings by combining:
- Severity: Base impact of the misconfiguration.
- Internet Exposure: Whether the resource is accessible from the public internet.
- Business Criticality: The importance of the service defined in the code.
Sources: web/aggregate-out/triage/index.html
Conclusion
Infrastructure as Code Security in this project is integrated through proactive scaffolding using Backstage templates and reactive scanning of Terraform and Kubernetes manifests. By enforcing network zoning, mandatory encryption, and automated secret management within the code, Fixops reduces the attack surface of the security platform itself and ensures compliance with bank-grade standards like PCI-DSS and SOC2.
Sources: archive/enterprise_legacy/backstage/template.yaml:10-50, demo_ssdlc_stages/02_design_architecture.yaml:100-120