사이버보안 GRC 13개 항목
Infrastructure-as-Code (Terraform) Security Review
이 체크리스트는 영어로 제공됩니다.
Reviews the security of infrastructure-as-code, focusing on Terraform, covering static analysis, policy-as-code, state protection, module trust, and drift.
CISNIST 800-53OWASP IaC
무료 PDF 또는 Word · 이메일을 입력하면 다운로드할 수 있습니다.
Static Analysis & Scanning
- Is IaC scanned for misconfigurations (e.g., tfsec, Checkov, Trivy) in the pipeline? *
- Are scan findings gated so high-severity issues block merge or apply? *
- Are secrets scanned for within IaC files and variables? *
Policy as Code
- Are guardrail policies (OPA/Sentinel) enforced against plans before apply? *
- Do policies prevent public exposure and unencrypted resources by default? *
- Is a plan review/approval step required before applying to production? *
State & Secrets Protection
- Is Terraform state stored in a secured, encrypted remote backend? *
- Is state locking enabled to prevent concurrent corrupting operations? *
- Is access to state restricted given it can contain sensitive values? *
- Are provider credentials sourced from short-lived, federated identities rather than static keys?
Modules & Drift
- Are external modules pinned to versions and sourced from a trusted registry? *
- Are provider and module versions constrained to prevent unexpected upgrades? *
- Is configuration drift between IaC and deployed infrastructure detected?
Infrastructure-as-Code (Terraform) Security Review 체크리스트 전체 다운로드
인쇄하기 좋은 PDF 또는 편집 가능한 Word 문서로 무료로 받으세요.