simpl.
Masuk
GRC Keamanan Siber 13 butir

Infrastructure-as-Code (Terraform) Security Review

Daftar periksa ini dalam bahasa Inggris.

Reviews the security of infrastructure-as-code, focusing on Terraform, covering static analysis, policy-as-code, state protection, module trust, and drift.

CISNIST 800-53OWASP IaC

PDF atau Word gratis · masukkan email Anda untuk mengunduh.

Static Analysis & Scanning

  • Is IaC scanned for misconfigurations (e.g., tfsec, Checkov, Trivy) in the pipeline? *
  • Are scan findings gated so high-severity issues block merge or apply? *
  • Are secrets scanned for within IaC files and variables? *

Policy as Code

  • Are guardrail policies (OPA/Sentinel) enforced against plans before apply? *
  • Do policies prevent public exposure and unencrypted resources by default? *
  • Is a plan review/approval step required before applying to production? *

State & Secrets Protection

  • Is Terraform state stored in a secured, encrypted remote backend? *
  • Is state locking enabled to prevent concurrent corrupting operations? *
  • Is access to state restricted given it can contain sensitive values? *
  • Are provider credentials sourced from short-lived, federated identities rather than static keys?

Modules & Drift

  • Are external modules pinned to versions and sourced from a trusted registry? *
  • Are provider and module versions constrained to prevent unexpected upgrades? *
  • Is configuration drift between IaC and deployed infrastructure detected?

Unduh daftar periksa Infrastructure-as-Code (Terraform) Security Review lengkap

Dapatkan secara gratis sebagai PDF yang rapi dan siap cetak atau dokumen Word yang dapat diedit.