Infrastructure as code (IaC) manages infrastructure through machine-readable code, making configurations repeatable across environments instead of relying on manual changes. section 1.2.3
Use IaC to make infrastructure more consistent and testable:
- Replicate infrastructure accurately across environments. section 1.2.3
- Choose provider-specific tools such as CloudFormation or Azure Resource Manager, or use Terraform across multiple clouds. section 1.2.3
- Audit and test configuration with static analysis tools such as tfsec. section 1.2.3
- Combine IaC with automated, repeatable deployment pipelines to prevent random manual changes. section 5.4
A safer deployment check
A deployment pipeline applies the infrastructure definition consistently, then runs smoke tests that check for exposed stack traces and incorrectly configured CORS headers. section 5.4
Figure 5.6 A common consequence of security misconfiguration is leaking stack traces in error responses. Stack traces often reveal sensitive information about our internal system configuration, and threat actors can exploit this information to design better strategies to break into our system.
Use the figure to see how a configuration mistake can expose stack traces and reveal internal system details to attackers. section 5.4
