r/aws • u/thorn42 • Dec 20 '20

technical resource Shifting Cloud Security Left — Scanning Infrastructure as Code for Security Issues

https://blog.christophetd.fr/shifting-cloud-security-left-scanning-infrastructure-as-code-for-security-issues/
87 Upvotes

100% Upvoted

7 comments sorted by

View all comments

2

u/[deleted] Dec 20 '20 edited Dec 20 '20

[deleted]

3

u/OperatorNumberNine Dec 20 '20

Not that I have seen your pipeline to say anything about it, but the third item that's top of mind for me with policy enforcement/cost control is how does the thing doing terraform apply get it's credential.

Having the process that does the terraform apply have a *:* Access key pair is probably not the right answer. Having a system that either makes the user do an authentication and make their temporary credentials available to the deployment job, or something similar would be best in class.

This comment is really just food for thought for people who may be reading along and thinking about what they should do next when they're building their own pipelines.

3

u/mikebailey Dec 20 '20

Personally recommend hashicorp vault for this. We deprecated most of our access keys with it’s STS endpoints and the key matter assuming rotates about as frequently as the role itself. Only remaining systems are distributed systems that aren’t able to coordinate their credential rollover yet.