Why security matters in IaC in Terraform - See It in Action

Why Security Matters in IaC

📖 Scenario: You are working as a cloud engineer. Your team uses Infrastructure as Code (IaC) to create cloud resources automatically. You want to make sure the cloud setup is safe from mistakes that could cause security problems.

🎯 Goal: Build a simple Terraform configuration that creates a cloud storage bucket with secure settings. This project will show why security matters in IaC by making sure the bucket is private and encrypted.

📋 What You'll Learn

Create a Terraform resource for a cloud storage bucket

Add a configuration variable to control public access

Use a condition to set the bucket to private if public access is disabled

Add encryption settings to the bucket

💡 Why This Matters

🌍 Real World

Cloud engineers use IaC to create and manage cloud resources quickly and consistently. Security settings like private access and encryption help protect data from leaks and attacks.

💼 Career

Understanding how to secure cloud resources with IaC is essential for cloud engineers, DevOps specialists, and security professionals to maintain safe and compliant cloud environments.

1

Create a Terraform resource for a cloud storage bucket

Write a Terraform resource block named aws_s3_bucket with the name secure_bucket and set the bucket name to my-secure-bucket-12345.

Terraform

# Your code here

Hint

Use the resource keyword to create an S3 bucket resource with the exact name and bucket name.

2

Add a configuration variable to control public access

Create a Terraform variable named allow_public_access of type bool and set its default value to false.

Terraform

resource "aws_s3_bucket" "secure_bucket" {
  bucket = "my-secure-bucket-12345"
}

# Your code here

Hint

Use the variable block to define a boolean variable with the exact name and default value.

3

Use a condition to set the bucket to private if public access is disabled

Add a acl attribute inside the aws_s3_bucket.secure_bucket resource. Set it to "private" if var.allow_public_access is false, otherwise set it to "public-read".

Terraform

resource "aws_s3_bucket" "secure_bucket" {
  bucket = "my-secure-bucket-12345"
  # Your code here
}

variable "allow_public_access" {
  type    = bool
  default = false
}

Hint

Use a conditional expression with var.allow_public_access to set the acl attribute.

4

Add encryption settings to the bucket

Inside the aws_s3_bucket.secure_bucket resource, add a server_side_encryption_configuration block that enables AES256 encryption.

Terraform

resource "aws_s3_bucket" "secure_bucket" {
  bucket = "my-secure-bucket-12345"
  acl    = var.allow_public_access ? "public-read" : "private"
  # Your code here
}

variable "allow_public_access" {
  type    = bool
  default = false
}

Hint

Add the server_side_encryption_configuration block with the correct nested structure and AES256 algorithm.

Practice

1. Why is security important when using Infrastructure as Code (IaC) like Terraform?

easy

A. It allows anyone to change infrastructure without review.

B. It makes the code run faster.

C. It helps prevent unauthorized access and mistakes early.

D. It reduces the cost of cloud resources automatically.

Solution

1. Step 1: Understand the role of security in IaC and compare options

   Security in IaC is designed to stop unauthorized access and prevent mistakes before they affect the infrastructure. Only "It helps prevent unauthorized access and mistakes early." correctly states the importance of security in preventing bad access and errors early.

2. Final Answer:

   It helps prevent unauthorized access and mistakes early. -> Option C

3. Quick Check:

   Security importance = Prevent unauthorized access [OK]

Hint: Security in IaC stops bad access and mistakes early [OK]

Common Mistakes:

• Thinking security only improves speed
• Believing security reduces costs automatically
• Assuming security allows open access

2. Which Terraform code snippet correctly restricts access to a resource using a security group rule?

easy

A. resource "aws_security_group_rule" "allow_ssh" { type = "ingress" from_port = 22 to_port = 22 protocol = "tcp" cidr_blocks = ["192.168.1.0/24"]}

B. resource "aws_security_group_rule" "allow_ssh" { type = "egress" from_port = 22 to_port = 22 protocol = "tcp" cidr_blocks = ["192.168.1.0/24"]}

C. resource "aws_security_group_rule" "allow_ssh" { type = "ingress" from_port = 22 to_port = 22 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"]}

D. resource "aws_security_group_rule" "allow_ssh" { type = "ingress" from_port = 80 to_port = 80 protocol = "tcp" cidr_blocks = ["192.168.1.0/24"]}

Solution

1. Step 1: Identify the correct rule type, port for SSH access, and restricted CIDR

   SSH uses TCP port 22 and requires an ingress rule to allow incoming connections. resource "aws_security_group_rule" "allow_ssh" {
type = "ingress"
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = ["192.168.1.0/24"]
} uses ingress, port 22, and restricts access to the 192.168.1.0/24 network, which is a limited range.

2. Final Answer:

   Ingress rule allowing TCP port 22 from 192.168.1.0/24 -> Option A

3. Quick Check:

   Correct port and restricted CIDR = resource "aws_security_group_rule" "allow_ssh" {
type = "ingress"
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = ["192.168.1.0/24"]
} [OK]

Hint: SSH needs ingress on port 22 with limited CIDR [OK]

Common Mistakes:

• Using egress instead of ingress for incoming access
• Allowing open access with 0.0.0.0/0
• Using wrong port like 80 for SSH

3. Given this Terraform snippet, what is the security risk?

resource "aws_s3_bucket" "example" {
  bucket = "my-secure-bucket"
  acl    = "public-read"
}

medium

A. The bucket allows public read access, risking data exposure.

B. The bucket is private and secure.

C. The bucket has no encryption enabled.

D. The bucket name is invalid.

Solution

1. Step 1: Understand the meaning of 'acl = "public-read"' and evaluate options

   This setting allows anyone on the internet to read the bucket contents, which is a security risk. "The bucket allows public read access, risking data exposure." correctly identifies the risk of public read access exposing data.

2. Final Answer:

   The bucket allows public read access, risking data exposure. -> Option A

3. Quick Check:

   Public-read ACL = Data exposure risk [OK]

Hint: Public-read ACL means open access to bucket data [OK]

Common Mistakes:

• Assuming public-read means private
• Ignoring encryption as the main risk here
• Thinking bucket name causes security issues

4. This Terraform code has a security issue. What is it?

resource "aws_security_group_rule" "allow_all" {
  type        = "ingress"
  from_port   = 0
  to_port     = 65535
  protocol    = "-1"
  cidr_blocks = ["0.0.0.0/0"]
}

medium

A. It only allows traffic on port 22.

B. It allows all inbound traffic from anywhere, which is unsafe.

C. It blocks all traffic, causing connectivity issues.

D. It uses an invalid protocol value.

Solution

1. Step 1: Analyze the rule's port/protocol settings and CIDR block

   From port 0 to 65535 with protocol "-1" means all ports and all protocols are allowed. Allowing 0.0.0.0/0 means any IP address can access all ports, which is a major security risk.

2. Final Answer:

   It allows all inbound traffic from anywhere, which is unsafe. -> Option B

3. Quick Check:

   Open all ports to all IPs = Unsafe [OK]

Hint: Allowing 0.0.0.0/0 on all ports is unsafe [OK]

Common Mistakes:

• Thinking it blocks traffic instead of allowing all
• Assuming only port 22 is allowed
• Believing protocol "-1" is invalid

5. You want to secure your Terraform-managed infrastructure by limiting access only to your office IP range 203.0.113.0/24. Which approach best follows security best practices?

hard

A. Set all security group ingress rules to allow 0.0.0.0/0 for simplicity.

B. Allow access from any IP but require a strong password.

C. Disable all security groups to avoid misconfiguration.

D. Use specific CIDR blocks like 203.0.113.0/24 in ingress rules and review regularly.

Solution

1. Step 1: Identify the best way to restrict access and consider ongoing practices

   Limiting access to a specific IP range reduces exposure and follows the principle of least privilege. Regularly reviewing and testing security settings ensures they remain effective and updated.

2. Final Answer:

   Use specific CIDR blocks like 203.0.113.0/24 in ingress rules and review regularly. -> Option D

3. Quick Check:

   Restrict access + regular review = Best practice [OK]

Hint: Limit access by CIDR and review often [OK]

Common Mistakes:

• Allowing open access for simplicity
• Disabling security groups entirely
• Relying only on passwords without network restrictions