P.K. SHARMA

Cyber security intelligence, AI governance, practitioner analysis

Cloud and subscribed services

Infrastructure blueprint (infrastructure as code): what it is and how it is attacked

The written description of what the cloud should contain, together with the record of what was actually built.

Also known as

  • infrastructure as code
  • IaC
  • Terraform
  • state file
  • CloudFormation
  • Bicep

Typing any of them into the editor finds this object.

Why it matters on a security diagram

It is a second way to change the estate that goes around every console, every approval and most of this diagram. The record it keeps is also a map of everything you own, and it often contains the passwords used along the way in readable form.

How it gets attacked, and what reduces it

How it gets attacked

  • The record file kept where more people can read it than can change the estate
  • Changes applied straight from a proposal before anyone has approved it
  • Building blocks pulled in from public sources and then run with full permissions

What reduces it

  • Protect the record file as a secret, because it contains them
  • Never apply from an unreviewed proposal
  • Pin and review third-party building blocks; they run with your permissions

Where it sits

Group
Cloud and subscribed services · Things that only exist because somebody else runs the platform underneath them.
Whose side, by default
Ours · Belongs to the organisation the diagram is about.
Catalogue identifier
iac-state

Reviewed . CC BY 4.0.

Others in cloud and subscribed services

The cloud and subscribed services group lists all 12 of them side by side.

Infrastructure blueprint on your own diagram

Open the editor, press N, and type infrastructure as code. The object is placed and connected to whatever was selected, and Tab adds the next one already joined to it. Nothing is uploaded: the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.

Open the diagram maker