<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-infrastructure-as-code-security
description: >-
  Scan Terraform, CloudFormation, Pulumi, and Kubernetes manifests for security
  misconfigurations using tfsec, checkov, KICS, and OPA. Enforce IaC security
  gates in CI/CD pipelines to prevent insecure infrastructure deployments.
domain: cybersecurity
subdomain: cloud-native-security
tags:
  - terraform
  - cloudformation
  - pulumi
  - tfsec
  - checkov
  - kics
  - iac-security
  - policy-as-code
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002"]
---

# Auditing Infrastructure-as-Code Security

## Overview

Infrastructure-as-Code (IaC) enables infrastructure drift and misconfiguration
to be caught before deployment. This skill covers multi-tool IaC scanning with
tfsec, checkov, and KICS across Terraform, CloudFormation, and Kubernetes
manifests with CI/CD pipeline integration.

Mode: `[MODE: BLUE]` — Preventive IaC scanning. `[MODE: ARCHITECT]` — Secure IaC design.

## Prerequisites

| Requirement | Details |
|---|---|
| tfsec >= 1.28 or trivy >= 0.50 | Required |
| checkov >= 3.0 | Required |
| Terraform >= 1.5 for plan scanning | Required |
| KICS >= 1.7 for multi-framework scanning | Required |

## Key Concepts

### Terraform Scanning with tfsec

```bash
# Scan current directory
tfsec . --format json --out results.json

# Scan with minimum severity
tfsec . --minimum-severity HIGH

# Scan Terraform plan
terraform plan -out=plan.tfplan
terraform show -json plan.tfplan > plan.json
tfsec --plan plan.json
```

### Checkov Multi-Framework Scanning

```bash
# Scan Terraform
checkov -d . --framework terraform --output json > checkov-tf.json

# Scan CloudFormation
checkov -f template.yaml --framework cloudformation

# Scan Kubernetes manifests
checkov -d k8s-manifests/ --framework kubernetes

# Scan with custom policies
checkov -d . --external-checks-dir ./custom-policies

# Soft-fail for CI (report but don't block)
checkov -d . --soft-fail-on LOW
```

### KICS (Keeping Infrastructure as Code Secure)

```bash
# Scan all IaC types
kics scan -p . -o results/ --report-formats json

# Scan specific type
kics scan -p . --type Terraform -o results/

# Exclude specific queries
kics scan -p . --exclude-queries "ID1,ID2"
```

### Common Terraform Misconfigurations

```hcl
# BAD: S3 bucket without encryption
resource "aws_s3_bucket" "bad" {
  bucket = "my-bucket"
  # Missing server_side_encryption_configuration
}

# GOOD: S3 bucket with encryption
resource "aws_s3_bucket" "good" {
  bucket = "my-bucket"
}

resource "aws_s3_bucket_server_side_encryption_configuration" "good" {
  bucket = aws_s3_bucket.good.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "aws:kms"
    }
  }
}

# BAD: Security group with 0.0.0.0/0 SSH
resource "aws_security_group_rule" "bad_ssh" {
  type        = "ingress"
  from_port   = 22
  to_port     = 22
  protocol    = "tcp"
  cidr_blocks = ["0.0.0.0/0"]  # tfsec: aws-ec2-no-public-ingress-sgr
}
```

## Workflow

```bash
# Step 1: Multi-scanner audit
node scripts/agent.js --action scan --path ./terraform --output /tmp/iac-audit.json

# Step 2: Review critical findings
cat /tmp/iac-audit.json | jq '.findings[] | select(.severity == "critical")'
```

## Detection

```yaml
title: Auditing Infrastructure As Code Security Detection
id: 4fa081de-e7e6-4c3f-b3d9-2d9f96cb9bb9
status: experimental
description: Detects suspicious activity related to auditing infrastructure as code security techniques in cloud native security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1195.002
  - attack.privilege_escalation
falsepositives:
  - Kubernetes controller reconciliation loops during cluster updates
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Auditing Infrastructure As Code Security Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1195.002 |

## Verification

- [ ] All IaC scanned in CI/CD before apply
- [ ] Zero CRITICAL/HIGH findings in production IaC
- [ ] S3 buckets encrypted with KMS
- [ ] Security groups have no 0.0.0.0/0 ingress on management ports
- [ ] RDS instances encrypted and not publicly accessible
- [ ] Custom policies enforce organization-specific standards

## References

- [tfsec Documentation](https://aquasecurity.github.io/tfsec/)
- [Checkov Documentation](https://www.checkov.io/1.Welcome/Quick%20Start.html)
- [CIS AWS Foundations Benchmark](https://www.cisecurity.org/benchmark/amazon_web_services)
