Infrastructure-as-Code Security Gaps

What this finding is

Infrastructure-as-code templates are not scanned for misconfiguration before apply, no policy-as-code gate blocks non-conforming changes, and no drift detection identifies manual modifications made outside the code path.

Why it is Tier 3

This is the highest-leverage preventive control available for cloud misconfiguration: a policy gate in the pipeline prevents the entire class of findings that otherwise arrives as Tier 1 public storage and open security groups. It is Tier 3 because it prevents future findings rather than remediating current ones — its value is measured in the Tier 1 items that never get created.

How to detect it

1. 1Check whether IaC scanning (Checkov, tfsec, Terrascan) runs in the pipeline and whether it blocks or merely reports.
2. 2Determine whether policy-as-code gates exist for high-risk resource configurations.
3. 3Run drift detection against deployed infrastructure to quantify manual changes.
4. 4Identify infrastructure not defined in code at all, which no gate can protect.

How to remediate it

Steps are ordered. The first step is the one that reduces exposure fastest, which is not always the one that closes the finding.

1. 1Add IaC scanning to the pipeline in reporting mode, fix the existing backlog, then switch to blocking.
2. 2Write policy-as-code rules for the configurations that produce Tier 1 findings — public storage, unrestricted ingress, unencrypted volumes — and block them at apply time.
3. 3Enable drift detection and alert on out-of-band changes.
4. 4Bring undefined infrastructure under code management, prioritising production.
5. 5Apply preventive guardrails (service control policies, Azure Policy) so the control holds even when the pipeline is bypassed.

How to verify the fix

Mappings

Other Tier 3 findings in Processing Protection