simpl.
Sign in
Cybersecurity GRC 13 items

Infrastructure-as-Code (Terraform) Security Review

Reviews the security of infrastructure-as-code, focusing on Terraform, covering static analysis, policy-as-code, state protection, module trust, and drift.

CISNIST 800-53OWASP IaC

Free PDF · enter your email to download.

Static Analysis & Scanning

  • Is IaC scanned for misconfigurations (e.g., tfsec, Checkov, Trivy) in the pipeline? *
  • Are scan findings gated so high-severity issues block merge or apply? *
  • Are secrets scanned for within IaC files and variables? *

Policy as Code

  • Are guardrail policies (OPA/Sentinel) enforced against plans before apply? *
  • Do policies prevent public exposure and unencrypted resources by default? *
  • Is a plan review/approval step required before applying to production? *

State & Secrets Protection

  • Is Terraform state stored in a secured, encrypted remote backend? *
  • Is state locking enabled to prevent concurrent corrupting operations? *
  • Is access to state restricted given it can contain sensitive values? *
  • Are provider credentials sourced from short-lived, federated identities rather than static keys?

Modules & Drift

  • Are external modules pinned to versions and sourced from a trusted registry? *
  • Are provider and module versions constrained to prevent unexpected upgrades? *
  • Is configuration drift between IaC and deployed infrastructure detected?

Download the full Infrastructure-as-Code (Terraform) Security Review checklist

Get it as a clean, printable PDF — free.