Infrastructure as code (IaC) describes the desired state of public-cloud infrastructure in code or templates. ARM, Bicep, Terraform, CloudFormation, and similar tools can deploy resources programmatically and make secure configuration the default rather than a manual afterthought. section 11.3
Use IaC to make infrastructure changes repeatable, track them with version control, and deliver approved updates through CI/CD. This helps prevent configuration drift, supports business continuity and disaster recovery, and lets teams deploy vulnerability fixes without manually changing production environments. section 11.3 section 11.9
IaC supports shifting security left by putting security configuration into the software development lifecycle. Detecting and correcting weaknesses earlier can reduce remediation costs and avoid taking revenue-producing applications offline to fix vulnerabilities or misconfigurations. section 11.1 section 11.2
A security-focused IaC workflow can:
- Store application and infrastructure changes in a source-code repository, then use Git history to track template or code changes over time. section 11.3
- Run configurable CI/CD workflows that build and test pull requests before merged changes reach production. section 11.3
- Apply consistent security settings across subscriptions, such as enabling Microsoft Defender for Cloud plans programmatically. section 11.3.1
Enable cloud protection across subscriptions
A developer commits application changes to GitHub while a security administrator uses IaC and a GitHub Actions workflow to keep Azure security settings consistent. The workflow authenticates to Azure with a service principal and can enable Defender for Cloud plans on subscriptions that host the application. section 11.3.1
Figure 11.4 The GitHub Actions workflow can be used to programmatically enable Defender CSPM plan on your Azure subscriptions.
This workflow diagram illustrates IaC-driven enablement of the Defender CSPM plan across Azure subscriptions. section 11.3.1
IaC is one layer of a DevSecOps approach, not a complete security solution. Pair it with shared visibility of security findings so developers and security teams can prioritize and fix weaknesses found in code and configuration. section 11.9
