# iac-security Published articles for iac-security. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Enforce custom rules in Datadog IaC Security scanning DevFeed: [Enforce custom rules in Datadog IaC Security scanning]() Original publisher: [Read original article]() Author: Chakib Hamie Published: 2026-09-18T00:00:00Z Content type: tutorial Language: en Sources: [Datadog]() Topics: [iac-security](), [Infrastructure as code](), [datadog](), [Security](), [Open Policy Agent](), [rego](), [configuration](), [Deployment](), [GitHub](), [Ansible](), [Dockerfile](), [GitHub Actions]() Tags: [code-security](), [configuration](), [datadog](), [deployment](), [devsecops](), [github-actions](), [iac](), [iac-security](), [infrastructure-as-code](), [open-policy-agent](), [policy](), [rego](), [security](), [security-rules](), [security-scanning]() ### AI overview This tutorial explains how to create, test, and publish custom Datadog IaC Security rules using Rego policies. These rules extend default checks to enforce organization-specific infrastructure standards, compliance requirements, and security controls across supported platforms. ### Source excerpt Create, test, and publish custom IaC Security rules in Datadog to detect organization-specific policy violations before deployment. ## JPMorgan Just Published a Cyber To-Do List and Snyk Covers 8 of the 10 Items. How do you stack up? DevFeed: [JPMorgan Just Published a Cyber To-Do List and Snyk Covers 8 of the 10 Items. How do you stack up?]() Original publisher: [Read original article]() Author: John Carione Published: 2026-04-23T00:00:00Z Content type: article Language: en Sources: [Snyk]() Topics: [Resilience](), [Security](), [snyk-iac](), [supply-chain-security](), [Vulnerabilities](), [Infrastructure as code](), [Open Source](), [AI Development](), [releases](), [Pull Request](), [Code]() Tags: [ai](), [ai-development](), [awareness](), [blog](), [cloud-security](), [code](), [contentlab](), [developer](), [devops](), [executive](), [iac-security](), [interest](), [open-source](), [open-source-security](), [pull-requests](), [releases](), [resilience](), [sbom](), [secrets](), [security](), [snyk-cloud](), [snyk-code](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [snyk-platform](), [snyk-security-intel](), [supply-chain-security](), [vulnerability]() ### AI overview JPMorganChase's 10-point cyber resilience checklist addresses enterprise security priorities spanning software versions, open-source dependencies, SBOMs, build pipelines, secrets, infrastructure as code, and AI development. The article explains how Snyk covers eight of the ten actions through developer workflows and its security platform. ### Source excerpt JPMorganChase published a 10-point cyber resilience checklist. See how Snyk covers 8 of the 10 actions and where it fits in your security stack. ## IaC Inventory: A Unified View Across Code, Deployments, and Cloud DevFeed: [IaC Inventory: A Unified View Across Code, Deployments, and Cloud]() Original publisher: [Read original article]() Author: Alex Kearns Published: 2026-04-17T15:00:01Z Content type: release Language: en Sources: [Wiz]() Topics: [Infrastructure as code](), [iac-security](), [ai security](), [pulumi](), [Cloud](), [Security]() Tags: [deployment](), [iac](), [iac-security](), [infrastructure](), [infrastructure-as-code](), [product-company-news](), [pulumi](), [securing-ai](), [security](), [wiz-code]() ### AI overview Wiz introduces IaC Inventory, a unified view connecting infrastructure-as-code modules, deployments, and live cloud resources. The release also adds Pulumi support and extends IaC security scanning across AWS, GCP, and Azure, including controls for AI resources and Bedrock Guardrails. ### Source excerpt As AI applications introduce a new class of infrastructure resources, visibility into what your IaC creates, where it runs, and whether it has drifted has never been more critical. ## Wiz Named a Leader in The Forrester Wave™: Cloud Native Application Protection Solutions, Q1 2026 DevFeed: [Wiz Named a Leader in The Forrester Wave™: Cloud Native Application Protection Solutions, Q1 2026]() Original publisher: [Read original article]() Author: Alyssa Stone Published: 2026-02-17T16:45:06Z Content type: release Language: en Sources: [Wiz]() Topics: [cloud security](), [Cloud](), [iac-security](), [ai security]() Tags: [2026](), [cloud](), [cloud-native](), [cloud-native-application-protection](), [cloud-security](), [cnapp](), [iac-security](), [multicloud](), [product](), [product-company-news](), [security-graph](), [wiz](), [wiz-platform]() ### AI overview Wiz announces that Forrester named it a Leader in the Q1 2026 Cloud Native Application Protection Solutions evaluation, with the highest Current Offering score. The announcement describes Wiz's approach to cloud security across code, infrastructure as code, runtime, multicloud environments, and agentic AI capabilities. ### Source excerpt Forrester's CNAPP evaluation rated Wiz with the highest Current Offering category score, which we believe reflects our commitment to protecting everything built and run in the cloud. ## How Snyk Helps Federal Agencies Prepare for the Genesis Mission Era of AI-Driven Science DevFeed: [How Snyk Helps Federal Agencies Prepare for the Genesis Mission Era of AI-Driven Science]() Original publisher: [Read original article]() Author: Phoebe Nerdahl Published: 2025-12-09T05:00:00Z Content type: article Language: en Sources: [Snyk]() Topics: [iac-security](), [CI/CD]() Tags: [ai](), [awareness](), [blog](), [ci-cd](), [cloud](), [container-security](), [containers](), [cybersecurity](), [data](), [datasets](), [developers](), [executive](), [government](), [iac-security](), [infrastructure-as-code](), [open-source](), [open-source-security](), [research](), [science](), [security](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [software](), [supply-chain]() ### AI overview Snyk explains how federal agencies can secure AI-driven scientific software, data pipelines, cloud resources, and software supply chains for the Genesis Mission. ### Source excerpt Snyk helps Federal Agencies secure software for the White House's Genesis Mission, accelerating AI-driven science. Implement Secure by Design for the supply chain, cloud, and pipelines. ## Wiz + HCP Terraform: Close the IaC-to-Cloud Infrastructure Security Gap DevFeed: [Wiz + HCP Terraform: Close the IaC-to-Cloud Infrastructure Security Gap]() Original publisher: [Read original article]() Author: Nadav Tzuker Published: 2025-09-23T15:00:49Z Content type: release Language: en Sources: [Wiz]() Topics: [iac-security](), [Terraform](), [cloud-infrastructure](), [Security](), [Deployment]() Tags: [cloud-infrastructure](), [deployment](), [developers](), [iac](), [iac-security](), [product-company-news](), [security](), [terraform](), [wiz](), [wiz-cloud](), [wiz-code]() ### AI overview Wiz announces the general availability of its HCP Terraform connector, adding zero-configuration code-to-cloud mapping that traces cloud risks to their infrastructure-as-code sources. The integration scans Terraform plans, applies security policies, and can block risky deployments before they reach production. ### Source excerpt Announcing the GA of our HCP Terraform connector, featuring new zero-configuration code-to-cloud mapping that traces any cloud risk back to its source. ## DevSecOps Automation Framework DevFeed: [DevSecOps Automation Framework]() Original publisher: [Read original article]() Author: Ben Desjardins Published: 2025-03-11T04:00:00Z Content type: article Language: en Sources: [Snyk]() Topics: [DevSecOps](), [Automation](), [Framework](), [Application Security](), [Software Testing](), [CI/CD](), [iac-security](), [Vulnerabilities]() Tags: [application-security](), [automation](), [awareness](), [blog](), [ci-cd](), [devops](), [devsecops](), [executive](), [framework](), [iac-security](), [infrastructure-as-code-iac](), [megawatt](), [security](), [snyk-platform](), [vulnerabilities]() ### AI overview This article explains how DevSecOps automation integrates security throughout the software development lifecycle. It discusses automation frameworks, automated security testing in CI/CD pipelines, early vulnerability detection, consistent security policies, compliance, SAST, and Infrastructure as Code security. ### Source excerpt Learn about the principles of DevSecOps automation, how to implement a DevSecOps automation strategy, & the best DevSecOps tools. ## Ensuring comprehensive security testing in DevOps pipelines DevFeed: [Ensuring comprehensive security testing in DevOps pipelines]() Original publisher: [Read original article]() Author: Jim Armstrong Published: 2024-10-17T05:00:00Z Content type: tutorial Language: en Sources: [Snyk]() Topics: [DevOps](), [DevSecOps](), [Security](), [Monitoring](), [sdlc]() Tags: [application-security](), [awareness](), [blog](), [cloud-security](), [code-security](), [container-security](), [devops](), [devsecops](), [executive](), [iac-security](), [megawatt](), [monitoring](), [open-source-security](), [pmm](), [sdlc](), [secrets](), [security](), [snyk-platform](), [testing]() ### AI overview This article explains why traditional security processes often create friction when inserted into DevOps pipelines and presents DevSecOps as a model that integrates security into software delivery. It focuses on comprehensive security testing and monitoring, risk-profile-based policies, threat modeling, security requirements gathering, and the use of SAST and SCA tools with IDEs for real-time feedback. ### Source excerpt Learn how to integrate comprehensive security testing into DevOps pipelines to protect your entire software development lifecycle. ## Detect Hardcoded Secrets Early to Reduce Data Breach Risk DevFeed: [Detect Hardcoded Secrets Early to Reduce Data Breach Risk]() Original publisher: [Read original article]() Author: Liran Tal Published: 2024-09-16T05:00:00Z Content type: tutorial Language: en Sources: [Snyk]() Topics: [software-development](), [sensitive data](), [Security](), [API keys](), [snyk](), [Authentication](), [passwords](), [JSON Web Tokens](), [ide](), [JavaScript]() Tags: [access-control](), [api-keys](), [application-security](), [authentication](), [awareness](), [blog](), [breach](), [code-security](), [developer](), [devops](), [devrel](), [devsecops](), [iac-security](), [javascript](), [jwt](), [passwords](), [secrets](), [security](), [sensitive-data](), [snyk-code](), [snyk-security-intel](), [supply-chain-security](), [vulnerability-insights]() ### AI overview This developer article explains that hardcoded secrets, including API keys, database credentials, passwords, encryption keys, and tokens, can expose applications to unauthorized access and data breaches. It describes using secrets detection during development to identify exposed credentials early, including through the Snyk IntelliJ IDE extension. ### Source excerpt Concerned about data breaches? Exposed secrets like API keys and passwords are a major culprit. Secure your software development lifecycle, identify and remove hardcoded secrets in code, and leverage Snyk's secrets detection tools to identify secrets early in development in order to prevent breaches and safeguard your applications. ## 5 reasons why developers at FinServ institutions are outpacing their security teammates DevFeed: [5 reasons why developers at FinServ institutions are outpacing their security teammates]() Original publisher: [Read original article]() Author: Katie DeMatteis Published: 2024-09-09T05:00:00Z Content type: article Language: en Sources: [Snyk]() Topics: [Application Security](), [iac-security](), [Vulnerabilities]() Tags: [ai](), [application-security](), [awareness](), [blog](), [ci-cd](), [cloud](), [devops](), [enablement](), [executive](), [finserv](), [iac-security](), [infrastructure-as-code](), [megawatt](), [vulnerabilities]() ### AI overview Financial-services development teams are adopting new technologies and cloud-based infrastructure-as-code quickly, while security teams struggle to adapt older application-security tools and processes to these environments. ### Source excerpt Learn why the development practices at financial services companies are outpacing older security technologies and techniques. ## Snyk highlights AWS re:Invent 2023 DevFeed: [Snyk highlights AWS re:Invent 2023]() Original publisher: [Read original article]() Author: David Lugo Published: 2023-12-14T06:00:00Z Content type: article Language: en Sources: [Snyk]() Topics: [Generative AI](), [ai security](), [Amazon Web Services](), [code security](), [Application Security](), [Application Development](), [Language models](), [cloud security](), [Infrastructure as code](), [container](), [sdlc]() Tags: [acquisition](), [ai](), [ai-code-security](), [ai-coding](), [ai-security](), [ai-tools](), [amazon](), [application-development](), [aspm](), [awareness](), [aws](), [blog](), [cloud](), [cloud-computing](), [code](), [code-security](), [coding](), [container-security](), [containers](), [devops](), [executive](), [generative-ai](), [iac-security](), [interest](), [megawatt](), [related-content](), [sdlc](), [security](), [security-solutions](), [snyk](), [snyk-apprisk](), [snyk-container](), [snyk-iac](), [tool]() ### AI overview This recap covers Snyk's AWS re:Invent 2023 highlights, including AWS partnership achievements, new AWS integrations, generative AI developments, and the use of AI coding assistants. It emphasizes the need for AI security solutions because AI-generated code can increase vulnerabilities. ### Source excerpt In this blog, we recap the most exciting developments from AWS re:Invent 2023, including Snyk's industry-leading progress with generative AI, ASPM, and the importance of AI security. ## Rego 103: Types of values and rules DevFeed: [Rego 103: Types of values and rules]() Original publisher: [Read original article]() Author: Jasper Van der Jeugt; Becki Lee Published: 2023-11-16T05:00:00Z Content type: article Language: en Sources: [Snyk]() Topics: [rego](), [Open Policy Agent](), [Infrastructure as code](), [Programming]() Tags: [beginner](), [blog](), [blog-post](), [cloud-security](), [code](), [developer](), [devrel](), [enablement](), [iac-security](), [infrastructure-as-code](), [learn](), [opa](), [policy](), [programming](), [rego](), [snyk-cloud](), [snyk-iac](), [types]() ### AI overview This beginner-focused article is the third part of a Rego introduction series. It explains scalar and composite value types, including strings, numbers, booleans, null, arrays, objects, and sets, and introduces set rules, object rules, functions, and iteration for writing policies evaluated by OPA. ### Source excerpt Learn about the different types of Values and Rules you can use to build policies in OPA & Rego. ## Rego 102: Combining queries with AND/OR and custom messages DevFeed: [Rego 102: Combining queries with AND/OR and custom messages]() Original publisher: [Read original article]() Author: Jasper Van der Jeugt; Becki Lee Published: 2023-11-09T06:00:00Z Content type: article Language: en Sources: [Snyk]() Topics: [rego](), [Open Policy Agent](), [Programming](), [Cloud](), [Infrastructure as code](), [JSON](), [YAML]() Tags: [beginner](), [blog](), [blog-post](), [cloud-security](), [code](), [developer](), [devrel](), [enablement](), [guide](), [how-to](), [iac-security](), [opa](), [policy](), [programming](), [rego](), [snyk-cloud](), [snyk-iac]() ### AI overview A beginner-focused guide to intermediate Rego syntax, explaining how to combine queries with AND and OR and introduce custom messages. It describes how OPA evaluates Rego policies against JSON or YAML input documents. ### Source excerpt Learn how to use AND and OR rules and custom messages using OPA and Rego in the second part of our beginner's guide to Rego. ## Rego 101: Introduction to Rego DevFeed: [Rego 101: Introduction to Rego]() Original publisher: [Read original article]() Author: Becki Lee Published: 2023-11-02T05:00:00Z Content type: tutorial Language: en Sources: [Snyk]() Topics: [rego](), [Open Policy Agent](), [Infrastructure as code](), [Security](), [Programming]() Tags: [blog](), [blog-post](), [cloud-security](), [developer](), [devrel](), [enablement](), [how-to](), [iac-security](), [infrastructure-as-code](), [infrastructure-as-code-iac](), [learn](), [opa](), [policy](), [rego](), [security](), [snyk-cloud](), [snyk-iac](), [tutorial]() ### AI overview A beginner-focused introduction to Rego, the declarative policy language used with Open Policy Agent (OPA). It explains policy as code, how OPA evaluates Rego policies, and how these policies can be applied to cloud and infrastructure-as-code resources. ### Source excerpt Learn how to write your first policy as code rules in Rego. This Rego tutorial for beginners covers the basics of Rego syntax and using OPA. ## Snyk Partner Speak video series with HashiCorp DevFeed: [Snyk Partner Speak video series with HashiCorp]() Original publisher: [Read original article]() Author: Sarah Conway Published: 2023-10-04T05:00:00Z Content type: news Language: en Sources: [Snyk]() Topics: [iac-security]() Tags: [application-security](), [automation](), [awareness](), [blog](), [cloud](), [cloud-infrastructure](), [deployment](), [developer](), [devops](), [executive](), [iac-security](), [infrastructure-as-code](), [partnership](), [related-content](), [security](), [series](), [snyk-iac](), [terraform](), [video](), [vulnerability](), [workflows]() ### AI overview Snyk and HashiCorp present a video about integrating security into development and deployment workflows. The partnership applies Snyk scanning and remediation to Terraform Cloud workflows to identify and fix infrastructure-as-code misconfigurations before production. ### Source excerpt The latest Snyk Partner Speak Series video showcases how Snyk and HashiCorp enable development teams to easily build and deploy applications with integrated security at every stage. ## Announcing IaC+ early access: Secure your infrastructure configurations across the SDLC DevFeed: [Announcing IaC+ early access: Secure your infrastructure configurations across the SDLC]() Original publisher: [Read original article]() Author: Lauren Place Published: 2023-10-03T13:00:00Z Content type: article Language: en Sources: [Snyk]() Topics: [iac-security](), [snyk-iac](), [Infrastructure as code](), [snyk](), [sdlc](), [Terraform](), [ide](), [Command-line interface](), [Continuous integration](), [Monitoring]() Tags: [acquisition](), [blog](), [ci](), [ci-cd](), [cli](), [cloud-security](), [compliance](), [convert-paid](), [devops](), [enablement](), [executive](), [iac](), [iac-security](), [ide](), [monitoring](), [pmm](), [preview](), [sdlc](), [security](), [snyk](), [snyk-iac](), [terraform]() ### AI overview Snyk announces IaC+, an early-access version of Snyk IaC available through Snyk Preview from October 3, 2023. It is designed to help developers find and fix infrastructure misconfigurations across the SDLC, from code to cloud, with improved pre-deployment analysis, broader security and compliance rules, and support for multi-file Terraform analysis. ### Source excerpt We're excited to announce that IaC+ is available in early access via Snyk Preview starting October 3rd, 2023.