# infrastructure as code (IAC) Published articles for infrastructure as code (IAC). This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Building Multi-Cloud Security Guardrails With Policy-as-Code, IAM, and Automated Remediation DevFeed: [Building Multi-Cloud Security Guardrails With Policy-as-Code, IAM, and Automated Remediation]() Original publisher: [Read original article]() Author: Malitha Thirumalai Published: 2026-10-26T21:13:07Z Content type: tutorial Language: en Sources: [HackerNoon]() Topics: [policy-as-code](), [CI/CD](), [Open Policy Agent](), [Security, Identity, & Compliance](), [Platform Engineering](), [GitHub](), [Serverless](), [Amazon VPC](), [azure functions](), [trivy](), [AWS IAM Identity Center](), [pulumi]() Tags: [2](), [automated](), [automated-remediation](), [aws](), [aws-security-guardrails](), [azure](), [building](), [cloud](), [cloud-iam-security](), [cloud-security](), [code](), [detection](), [devsecops](), [gcp](), [guardrails](), [iam](), [infrastructure-as-code-iac](), [infrastructure-drift-detection](), [least-privilege](), [multi-cloud-security](), [policy](), [policy-as-code](), [remediation](), [security](), [using](), [with]() ### AI overview The article recommends treating cloud security controls as enforceable guardrails across AWS, Azure, and GCP. It proposes blocking noncompliant infrastructure plans in CI with IaC scanners and OPA or Sentinel, with provider-specific storage policies; restricting production console writes and detecting drift through scheduled AWS plans, Azure Resource Graph or Automation, and GCP Asset Inventory or query tools; and using OIDC federation for short-lived credentials plus organization-level deny policies. It also advocates assessing chained attack paths, least-privilege identities, default-deny east-west traffic, and egress controls. For runtime drift, it outlines provider-native event-driven remediation and says fixes should update IaC through pull requests. The article cautions that direct automated changes can conflict with Terraform state, and recommends progressing carefully because deleting noncompliant production resources can disrupt services. ### Source excerpt Learn how to secure AWS, Azure, and GCP using policy-as-code, drift detection, least-privilege IAM, microsegmentation, and automated remediation. ## How to Build a Self Service Cloud API on AWS With Crossplane DevFeed: [How to Build a Self Service Cloud API on AWS With Crossplane]() Original publisher: [Read original article]() Author: Pramodh Kumar M Published: 2026-10-04T17:00:03Z Content type: tutorial Language: en Sources: [KodeKloud]() Topics: [platform engineering automation](), [internal developer platform](), [Amazon EC2](), [Amazon Web Services](), [Service fabric]() Tags: [aws](), [cloud](), [cloud-native](), [compositeresourcedefinition](), [composition-functions](), [crossplane](), [crossplane-aws](), [crossplane-composition](), [crossplane-tutorial](), [crossplane-v2](), [crossplane-vs-terraform](), [developer](), [devops](), [how-to](), [iac](), [infrastructure-as-code-iac](), [kubernetes](), [kubernetes-control-plane](), [management-policies](), [platform](), [platform-engineering](), [self-service](), [self-service-infrastructure]() ### AI overview This hands-on tutorial builds a self-service cloud API with Crossplane, Kubernetes, and AWS. It guides platform engineers through defining an AppBucket API, composing secure S3 resources, and granting teams namespace-scoped access without exposing AWS credentials. The project also demonstrates reconciliation, changes to compositions, and resource adoption. ### Source excerpt A developer should not need a ticket, a copied Terraform module or an AWS login to get a bucket. Build the Kubernetes API that hands them one in seconds of typing, with every platform rule already inside it. ## Architecting a secure landing zone in the AWS European Sovereign Cloud DevFeed: [Architecting a secure landing zone in the AWS European Sovereign Cloud]() Original publisher: [Read original article]() Author: Pablo Pagani Published: 2026-09-16T21:20:48Z Content type: article Language: en Sources: [AWS Security Blog]() Topics: [Amazon Web Services](), [Cloud](), [software-architecture](), [AWS IAM](), [Infrastructure as code](), [CI/CD](), [Security Information and Event Management (SIEM)](), [Incident response]() Tags: [advanced-300](), [aws](), [aws-identity-and-access-management-iam](), [ci-cd](), [cloud](), [eu](), [europe](), [incident-response](), [infrastructure-as-code-iac](), [partition](), [security](), [security-blog](), [security-identity-compliance](), [technical-how-to]() ### AI overview This article explains how to architect a secure, scalable landing zone in the AWS European Sovereign Cloud. It describes the aws-eusc partition boundary and covers governance, identity, logging, data protection, network design, CI/CD, artifact distribution, and incident response. ### Source excerpt The AWS European Sovereign Cloud is a new, independent cloud for Europe, physically and logically separate from existing AWS Regions and operated within the European Union (EU). It provides the same services, features, and APIs as AWS commercial Regions, but runs as a distinct AWS partition (aws-eusc), with its own control plane, AWS Identity and [...] ## Operationalizing least privilege: Automate IAM remediation through your CI/CD pipeline DevFeed: [Operationalizing least privilege: Automate IAM remediation through your CI/CD pipeline]() Original publisher: [Read original article]() Author: Luis Pastor Published: 2026-09-15T15:53:51Z Content type: tutorial Language: en Sources: [AWS Security Blog]() Topics: [AWS IAM](), [CI/CD](), [Infrastructure as code](), [AWS CloudFormation](), [Amazon Web Services]() Tags: [aws](), [aws-cloudformation](), [aws-cloudtrail](), [aws-iam](), [aws-identity-and-access-management-iam](), [aws-organizations](), [best-practices](), [ci-cd](), [expert-400](), [iam](), [infrastructure-as-code-iac](), [least-privilege](), [pull-request](), [security](), [security-blog](), [security-identity-compliance](), [technical-how-to]() ### AI overview This article describes an automated workflow for operationalizing least privilege in AWS. It explains how AWS IAM Access Analyzer identifies unused permissions and how remediation can be routed through different paths for infrastructure-as-code-managed, manually created, and unused IAM principals. ### Source excerpt The principle of least privilege is straightforward to articulate but challenging to maintain at scale. When teams first deploy applications to AWS, they often grant broader permissions than strictly necessary; it's faster to get things working, and the plan is always to tighten permissions later. But later rarely comes. Permissions accumulate, AWS Identity and Access [...] ## KCP: How to Migrate to Confluent Cloud in Days, Not Weeks DevFeed: [KCP: How to Migrate to Confluent Cloud in Days, Not Weeks]() Original publisher: [Read original article]() Author: Ahmed Saef Zamzam Published: 2026-09-14T07:00:00Z Content type: tutorial Language: en Sources: [Confluent: Data in motion]() Topics: [Apache Kafka](), [migration](), [Confluent Cloud](), [Replication](), [Infrastructure as code](), [Provisioning](), [Access Control](), [Structured-data]() Tags: [access-control](), [confluent](), [confluent-cloud](), [data-replication](), [infrastructure-as-code-iac](), [kafka](), [migration](), [open-source](), [provisioning](), [replication](), [schema]() ### AI overview The article explains how Confluent's open source KCP tool automates migration from Amazon MSK to Confluent Cloud. KCP supports discovery, infrastructure provisioning, ACL and schema mapping, and migration, while Cluster Linking provides offset-preserving data replication. Support for self-managed Kafka migrations is described as coming soon. ### Source excerpt Use Kafka Copy Paste (KCP) to automate Kafka migration with infrastructure generation, ACL and schema mapping, and offset-preserving data replication. ## Now generally available: See how Stack Automation by Quali cuts deployment time DevFeed: [Now generally available: See how Stack Automation by Quali cuts deployment time]() Original publisher: [Read original article]() Author: Carlos Campos Torres Published: 2026-09-09T15:00:14Z Content type: article Language: en Sources: [Cisco Blogs]() Topics: [Automation](), [Deployment](), [Provisioning](), [configuration](), [cloud-infrastructure](), [Cloud]() Tags: [agenticops](), [automation](), [cloud](), [data-center](), [deployment](), [documentation](), [infrastructure](), [infrastructure-as-code-iac](), [platform](), [software](), [ubuntu](), [windows]() ### AI overview Stack Automation by Quali, co-developed with Cisco, is generally available as a deployment automation platform for validated Cisco and third-party infrastructure solutions. Its Solutions Hub supports planning, modeling, bill of materials generation, and automated deployment across on-premises and public-cloud services, reducing deployment cycles from weeks to hours or minutes. ### Source excerpt Still burning weeks on manual infrastructure deployment? Stack Automation by Quali, co-developed with Cisco, is now available--turning that grind into an automated, cloud-like experience that takes minutes. ## Pulumi Context API: query your infrastructure as a graph DevFeed: [Pulumi Context API: query your infrastructure as a graph]() Original publisher: [Read original article]() Author: Levi Blackstone Published: 2026-08-26T00:00:00Z Content type: release Language: en Sources: [Pulumi]() Topics: [pulumi](), [Infrastructure as code](), [pulumi-cli](), [pulumi-neo](), [REST API]() Tags: [agent](), [agents](), [ai-agents](), [api](), [aws](), [cleanup](), [cli](), [dependencies](), [discovery](), [enterprise](), [features](), [graph](), [iac](), [impact](), [infrastructure](), [infrastructure-as-code-iac](), [product](), [pulumi](), [pulumi-cloud](), [query](), [relationships](), [resources](), [rest](), [rest-api]() ### AI overview Pulumi's read-only Context API connects Pulumi-managed and discovered resources, stacks, and their relationships into a queryable infrastructure graph. JSON queries specify starting nodes, relationship traversals, and returned results; they can run through the Pulumi CLI or REST API. The excerpt illustrates finding resources managed by AWS provider instances below version 7.0.0 and describes impact, infrastructure coverage, and cleanup queries. Pulumi Neo uses the API with the invoking user's permissions; other agents that can run authenticated Pulumi CLI commands can retrieve its graph vocabulary and query guidance. Public preview is available to Enterprise and Business Critical organizations. The excerpt points to guidance for assessing answer completeness but does not include its details. ### Source excerpt Every platform team fields the same questions: What is running? What breaks if we change this? What can we safely delete? The answers exist, but they're scattered across state files, cloud consoles, and the memories of whoever set things up. Today we're launching the Pulumi Context API, a read-only API that connects Pulumi-managed and discovered resources, stacks, and their relationships into a graph. It's designed agent-first: Pulumi Neo, our infrastructure agent, uses it out of the box, and other agents can fetch the current graph vocabulary and query guidance on demand. It's available in public preview for organizations on the Enterprise and Business Critical editions. Answers that follow infrastructure relationships Pulumi already records the resources your programs manage, their dependencies, how stacks consume each other's outputs, and the resources Pulumi Discovery finds outside infrastructure as code (IaC). The Context API connects this data so you can ask questions that depend on the relationships: Impact: Which stacks are affected if we upgrade this provider? If this stack changes, what consumes its outputs? Coverage: How much of our infrastructure lives outside IaC, and in which accounts? Cleanup: Which stacks have no dependents and are candidates for retirement? A query is a JSON document with a handful of clauses. anchor names the starting nodes, traverse follows relationships from there, and return chooses what comes back. You can run a query through the Pulumi CLI or REST API. Here's a selector that starts from AWS provider instances older than version 7.0.0 and follows incoming provided_by relationships back to the visible resources they manage: { "anchor": { "nodeType": "resource", "match": { "type": "pulumi:providers:aws", "fields": { "provider_version": { "op": "lt", "value": "7.0.0" } } } }, "traverse": [ { "edgeTypes": ["provided_by"], "direction": "in", "alias": "managed" } ], "return": { "select": ["anchor", "managed"] } } A response for one m ## From clickops to governed IaC: CloudFormation drift detection in practice DevFeed: [From clickops to governed IaC: CloudFormation drift detection in practice]() Original publisher: [Read original article]() Author: Leen Alattas Published: 2026-08-21T10:48:22Z Content type: tutorial Language: en Sources: [AWS DevOps & Developer Productivity Blog]() Topics: [AWS CloudFormation](), [Infrastructure as code](), [Amazon Web Services](), [AWS Management Console](), [Provisioning](), [Amazon EC2](), [Amazon S3](), [Amazon VPC](), [AWS IAM](), [Command-line interface](), [SDK]() Tags: [amazon-ec2](), [amazon-s3](), [amazon-vpc](), [automate](), [aws](), [aws-cli](), [aws-cloudformation](), [aws-identity-and-access-management-iam](), [aws-management-console](), [best-practices](), [cdk](), [cicd](), [cli](), [cloudformation](), [declarative](), [developer-tools](), [devops](), [iac](), [infrastructure](), [infrastructure-as-code](), [infrastructure-as-code-iac](), [sdks](), [thought-leadership](), [workflow]() ### AI overview This practical article explains how AWS teams can move infrastructure created through console, CLI, or SDK-based ClickOps into governed Infrastructure as Code. It describes CloudFormation's IaC Generator, which scans existing resources and produces templates, then outlines the review and operational decisions needed for long-term governance and automation. ### Source excerpt AWS environments that have grown organically over time often share a common characteristic: infrastructure provisioned through the AWS Management Console, SDKs, or CLI without corresponding Infrastructure as Code (IaC) templates. This practice is commonly referred to as "ClickOps," a term describing any infrastructure change made outside of a codified, version-controlled workflow. Whether changes happen through [...] ## How Wiz's Product Security Team Uses Cloud Security Automation DevFeed: [How Wiz's Product Security Team Uses Cloud Security Automation]() Original publisher: [Read original article]() Author: John Elliot Published: 2026-07-09T16:20:08Z Content type: article Language: en Sources: [Wiz]() Topics: [Security](), [cloud security](), [iac-security](), [CI/CD](), [policy-as-code](), [Kubernetes](), [threat detection](), [Command-line interface](), [Vulnerabilities](), [GitHub]() Tags: [automation](), [cli](), [cloud-security](), [detection](), [github](), [infrastructure](), [infrastructure-as-code-iac](), [kubernetes](), [policy-as-code](), [security](), [wiz-behind-the-scenes]() ### AI overview This article describes how Wiz's Product Security team integrates cloud security into developer workflows and infrastructure operations. It covers CLI scanning in CI/CD and pull requests, cloud configuration rules, custom Rego policy-as-code, IaC and artifact scanning, Kubernetes admission controls, and automated threat detection. ### Source excerpt Automation, resilience, and security for the modern age ## Best Infrastructure as Code (IaC) Tools for 2026 DevFeed: [Best Infrastructure as Code (IaC) Tools for 2026]() Original publisher: [Read original article]() Author: Isaac Harris Published: 2026-07-05T00:00:00Z Content type: article Language: en Sources: [Pulumi]() Topics: [Infrastructure as code](), [pulumi](), [opentofu](), [Terraform](), [software-development](), [domain-specific language](), [Programming]() Tags: [2026](), [abstraction](), [agent](), [agent-readiness](), [ai-agent](), [alternatives](), [analysis](), [application-development](), [approach](), [arm](), [aws](), [aws-cdk](), [aws-cloudformation](), [azure](), [best](), [code](), [devops](), [general](), [google-cloud](), [iac](), [infrastructure](), [infrastructure-as-code](), [infrastructure-as-code-iac](), [kubernetes](), [terraform](), [tools]() ### AI overview The excerpt lists ten IaC options spanning general-purpose programming languages, declarative templates, and Kubernetes-based approaches. It frames licensing, pricing, and AI-agent readiness as tradeoffs to weigh, and notes that Pulumi's registry includes first-party, bridged Terraform, and community packages. For teams with complex requirements or programming backgrounds, it says general-purpose languages can offer advantages in testing, abstraction, and collaboration; templates and domain-specific languages remain effective for many use cases. The excerpt describes the guide's scope but provides no tool-by-tool comparisons or selection criteria. ### Source excerpt The best infrastructure as code (IaC) tools in 2026 are Pulumi, Terraform, OpenTofu, AWS CDK, AWS CloudFormation, Azure ARM, Azure Bicep, Google Cloud Infrastructure Manager, Kubernetes YAML, and Crossplane. Each takes a different approach to defining and provisioning infrastructure, from general-purpose programming languages to declarative templates, and each carries distinct licensing, pricing, and AI-agent readiness tradeoffs worth weighing before you commit. Pulumi's own package registry lists hundreds of packages -- first-party providers, bridged Terraform providers, and community components -- illustrating how far multi-cloud coverage has expanded across the ecosystem. Since this post was published, Pulumi has added first-class support for HashiCorp Configuration Language (HCL). You can now write Pulumi programs in HCL directly, alongside general-purpose languages like TypeScript, Python, Go, and C#. To see how it works, see Pulumi HCL. As infrastructure complexity grows, teams increasingly seek approaches that provide the same developer productivity tools they use for application development. While template-based and domain-specific language approaches serve many use cases effectively, teams with complex requirements or programming backgrounds often find that general-purpose programming languages offer advantages in testing, abstraction, and collaboration. This comprehensive guide examines the most effective infrastructure as code tools available today, providing detailed analysis of core IaC platforms, complementary tools, and related technologies through the lens of software engineering best practices. Whether you're starting fresh with IaC or evaluating alternatives to overcome limitations in your current toolchain, we'll help you navigate this complex landscape and choose solutions that truly bring software engineering to infrastructure. Ready to try one of these approaches yourself? Get started with Pulumi for free and provision your first resource in minu ## How Terraform Works DevFeed: [How Terraform Works]() Original publisher: [Read original article]() Author: Saurabh Dashora Published: 2026-05-05T07:41:46Z Content type: tutorial Language: en Sources: [System Design Codex]() Topics: [Terraform](), [Infrastructure as code](), [Provisioning](), [CI/CD](), [Pull Request](), [Command-line interface]() Tags: [changes](), [ci-cd](), [hcl](), [infrastructure-as-code-iac](), [plan](), [preview](), [provisioning](), [terraform]() ### AI overview A step-by-step introduction to how Terraform uses Infrastructure as Code and HCL configurations to define resources, preview changes with Terraform Plan, and provision infrastructure with Terraform Apply. It also explains providers, variables, modules, state, workspaces, and CI/CD or pull-request workflows. ### Source excerpt Step by step ## Infrastructure as code: Where are we today? DevFeed: [Infrastructure as code: Where are we today?]() Original publisher: [Read original article]() Author: Richard Gall Published: 2025-04-23T00:00:00Z Content type: article Language: en Sources: [Thoughtworks Insights]() Topics: [Infrastructure as code](), [Platform Engineering](), [Provisioning](), [Automation](), [Deployment](), [configuration-management](), [Cloud](), [Code]() Tags: [2025](), [automation](), [configuration-management](), [deployment](), [iac](), [infrastructure](), [infrastructure-as-code](), [infrastructure-as-code-iac](), [platform](), [platform-engineering](), [provisioning]() ### AI overview An interview with Kief Morris examines how infrastructure as code has evolved alongside cloud-scale engineering and organizational needs. The discussion covers business-oriented infrastructure design, self-service provisioning through platform engineering, automated deployment, and the persistence of siloed infrastructure workflows that can hinder software delivery. ### Source excerpt Infrastructure as code: Where are we today? ## DevSecOps Automation Framework DevFeed: [DevSecOps Automation Framework]() Original publisher: [Read original article]() Author: Ben Desjardins Published: 2025-03-11T04:00:00Z Content type: article Language: en Sources: [Snyk]() Topics: [DevSecOps](), [Automation](), [Framework](), [Application Security](), [Software Testing](), [CI/CD](), [iac-security](), [Vulnerabilities]() Tags: [application-security](), [automation](), [awareness](), [blog](), [ci-cd](), [devops](), [devsecops](), [executive](), [framework](), [iac-security](), [infrastructure-as-code-iac](), [megawatt](), [security](), [snyk-platform](), [vulnerabilities]() ### AI overview This article explains how DevSecOps automation integrates security throughout the software development lifecycle. It discusses automation frameworks, automated security testing in CI/CD pipelines, early vulnerability detection, consistent security policies, compliance, SAST, and Infrastructure as Code security. ### Source excerpt Learn about the principles of DevSecOps automation, how to implement a DevSecOps automation strategy, & the best DevSecOps tools. ## Authorized Agility: Wiz adds Code Security in the FedRAMP offering (Wiz for Gov) DevFeed: [Authorized Agility: Wiz adds Code Security in the FedRAMP offering (Wiz for Gov)]() Original publisher: [Read original article]() Author: Lauren Place Published: 2024-12-09T12:00:01Z Content type: release Language: en Sources: [Wiz]() Topics: [software-development](), [Application Security](), [cloud security](), [CI/CD](), [iac-security]() Tags: [application-security](), [ci-cd](), [code-security](), [fedramp](), [infrastructure-as-code-iac](), [product](), [public-sector](), [security](), [wiz](), [wiz-code]() ### AI overview Wiz announces that Wiz Code is generally available within its FedRAMP-authorized Wiz for Government offering. The addition connects cloud and application security by extending security policies and scanning across development workflows, code libraries, base images, infrastructure as code, and exposed secrets. ### Source excerpt Wiz is excited to announce the addition of Wiz Code into our Wiz for Gov offering, enabling organizations to visualize attack paths from cloud-to-code and bring guardrails into the software development lifecycle. ## Introducing Netdata's Dynamic Configuration Manager DevFeed: [Introducing Netdata's Dynamic Configuration Manager]() Original publisher: [Read original article]() Published: 2024-06-05T00:00:00Z Content type: release Language: en Sources: [Netdata]() Topics: [configuration](), [Monitoring](), [dashboards](), [Infrastructure as code]() Tags: [alert](), [configuration](), [dashboard](), [infrastructure-as-code-iac](), [monitoring](), [workflows]() ### AI overview Netdata introduces Dynamic Configuration Manager, a feature for managing monitoring and alerting configurations through dashboards, configuring collectors from the Integrations section, submitting configurations to multiple nodes, and copying configurations into Infrastructure as Code workflows. ### Source excerpt We are thrilled to unveil the latest addition to the Netdata platform: the Dynamic Configuration Manager. This powerful new feature revolutionizes how you manage your monitoring and alerting configurations, making it easier and more efficient than ever before. Key Features of the Dynamic Configuration Manager Create and Modify Alerts from Every Chart You can now create and modify alerts directly from any chart on your dashboard or from the dedicated Alerts tab. This streamlined process allows for quick adjustments and ensures your monitoring is always aligned with your current needs. Configure Collectors from the Integrations Section on the Dashboard Currently available for go.d collectors, this feature lets you configure collectors straight from the Integrations section. This means you can quickly identify what Netdata can monitor and set up your configurations in one go, without having to dig through multiple settings pages. Submit Configurations to Multiple Nodes with One Click Managing configurations across a large infrastructure can be time-consuming. With the Dynamic Configuration Manager, you can now submit configurations to multiple nodes simultaneously, saving you valuable time and effort. Construct and Copy Configurations for IaC Solutions For those using Infrastructure as Code (IaC) solutions, this feature allows you to construct and copy configurations easily, integrating them into your IaC workflows. This ensures your configurations are consistent and reproducible across different environments. How to Use the Dynamic Configuration Manager To help you get started with the Dynamic Configuration Manager, we've put together a quick guide using the Netdata demo environment. ## Move Fast and "Branch" Things DevFeed: [Move Fast and "Branch" Things]() Original publisher: [Read original article]() Author: Stephen Siegert Published: 2024-04-15T16:38:10Z Content type: article Language: en Sources: [Neon Docs]() Topics: [Database](), [Infrastructure as code](), [Serverless](), [autoscaling](), [Cloud](), [Provisioning](), [Amazon RDS](), [Amazon Web Services]() Tags: [amazon-rds](), [autoscaling](), [availability](), [cloud](), [community](), [database](), [iam](), [infrastructure-as-code-iac](), [networking](), [provisioning](), [serverless]() ### AI overview Neon presents scalable Postgres with database branching, autoscaling, and serverless scale to zero as a way to reduce infrastructure complexity from development through production. The article contrasts this approach with traditional AWS RDS and Google Cloud SQL setups that require extensive infrastructure-as-code, networking, access management, high availability, scaling, backup, and cost planning. ### Source excerpt Neon simplifies the use of scalable Postgres, changing how you handle your database infrastructure from development through production. This is a fundamental shift in how to leverage your Postgres infrastructure. Instead of spending time on Infrastructure as code (IaC) and cloud-... ## Rego 101: Introduction to Rego DevFeed: [Rego 101: Introduction to Rego]() Original publisher: [Read original article]() Author: Becki Lee Published: 2023-11-02T05:00:00Z Content type: tutorial Language: en Sources: [Snyk]() Topics: [rego](), [Open Policy Agent](), [Infrastructure as code](), [Security](), [Programming]() Tags: [blog](), [blog-post](), [cloud-security](), [developer](), [devrel](), [enablement](), [how-to](), [iac-security](), [infrastructure-as-code](), [infrastructure-as-code-iac](), [learn](), [opa](), [policy](), [rego](), [security](), [snyk-cloud](), [snyk-iac](), [tutorial]() ### AI overview A beginner-focused introduction to Rego, the declarative policy language used with Open Policy Agent (OPA). It explains policy as code, how OPA evaluates Rego policies, and how these policies can be applied to cloud and infrastructure-as-code resources. ### Source excerpt Learn how to write your first policy as code rules in Rego. This Rego tutorial for beginners covers the basics of Rego syntax and using OPA. ## The Danger of Falling to System Role in AWS SDK Client DevFeed: [The Danger of Falling to System Role in AWS SDK Client]() Original publisher: [Read original article]() Published: 2022-10-17T22:00:00Z Content type: article Language: en Sources: [Doyensec]() Topics: [Amazon Web Services](), [Authorization](), [HashiCorp Vault]() Tags: [amazon-web-services](), [application-security](), [auditing](), [automation](), [aws](), [aws-sdk](), [bugs](), [client](), [cloud-infrastructure](), [cloud-security](), [cloud-services](), [credentials](), [doyensec](), [doyensecurity](), [end-user](), [exploit](), [hacking](), [iac](), [iam](), [infosec](), [infrastructure-as-code](), [infrastructure-as-code-iac](), [keys](), [laboratory](), [offensive](), [pentest](), [pentester](), [reverse-engineering](), [sdk](), [security](), [system](), [vulnerability]() ### AI overview In an AWS SDK for Go (v1) S3 import feature, an error handler cleared the configured credentials and retried the request. With credentials set to nil, the SDK used its provider chain, which could assume the host's IAM role; the article's case study says that role had access to internal S3 buckets, allowing a user who knew bucket names to import their contents. The article distinguishes this from `AnonymousCredentials`, which keeps requests unsigned for public resources, and static credentials, which use supplied keys. It advises auditors to trace user-reachable client initialization and fallback paths, then examine role permissions. For developers, it recommends anonymous credentials for public resources and avoiding fallback to the system role when integrating user-provided credentials. ### Source excerpt Introduction to the series When it comes to Cloud Security, the first questions usually asked are: How is the infrastructure configured? Are there any public buckets? Are the VPC networks isolated? Does it use proper IAM settings? As application security engineers, we think that there are more interesting and context-related questions such as: Which services provided by the cloud vendor are used? Among the used services, which ones are directly integrated within the web platform logic? How is the web application using such services? How are they combined to support the internal logic? Is the usage of services ever exposed or reachable by the end-user? Are there any unintended behaviors caused by cloud services within the web platform? By answering these questions, we usually find bugs. Today we introduce the "CloudSecTidbits" series to share ideas and knowledge about such questions. CloudSec Tidbits is a blogpost series showcasing interesting bugs found by Doyensec during cloud security testing activities. We'll focus on times when the cloud infrastructure is properly configured, but the web application fails to use the services correctly. Each blogpost will discuss a specific vulnerability resulting from an insecure combination of web and cloud related technologies. Every article will include an Infrastructure as Code (IaC) laboratory that can be easily deployed to experiment with the described vulnerability. Tidbit # 1 - The Danger of Falling to System Role in AWS SDK Client Amazon Web Services offers a comprehensive SDK to interact with their cloud services. Let's first examine how credentials are configured. The AWS SDKs require users to pass access / secret keys in order to authenticate requests to AWS. Credentials can be specified in different ways, depending on the different use cases. When the AWS client is initialized without directly providing the credential's source, the AWS SDK acts using a clearly defined logic. The AWS SDK uses a different credential p ## AWS IAM in layman's terms DevFeed: [AWS IAM in layman's terms]() Original publisher: [Read original article]() Author: info@goteleport.com (Shuo Yang) Published: 2021-06-16T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [AWS IAM](), [identity and access management](), [Access Control](), [Authorization](), [software-development](), [Security](), [Infrastructure as code]() Tags: [access-control](), [aws-iam](), [cybersecurity](), [development](), [diagram](), [figure](), [how-to](), [iam](), [infrastructure-as-code-iac](), [policy](), [programming](), [security]() ### AI overview This tutorial explains AWS IAM roles, STS, identity pools, and IAM policy mechanisms. It focuses on separating access-control responsibilities between central security or platform teams and individual application development teams, including the interaction between permission boundaries and identity-based policies. ### Source excerpt Learn how to leverage the right AWS IAM policy mechanisms to build responsibility separation between a central platform team and individual development teams.