# iac-security The practice of securing infrastructure-as-code configurations by identifying and remediating misconfigurations throughout development and deployment workflows. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Beyond the Merge: Enforcing Policy Before the Terraform Apply DevFeed: [Beyond the Merge: Enforcing Policy Before the Terraform Apply]() Original publisher: [Read original article]() Author: Sachin Agarwal Published: 2026-09-03T17:25:32Z Content type: article Language: en Sources: [Nirmata]() Topics: [iac-security](), [Terraform](), [Security](), [Kyverno](), [Tooling]() Tags: [ci](), [cloud-security](), [code-security](), [infrastructure-as-code](), [kyverno](), [other](), [policy-as-code](), [pull-request](), [scanner](), [security](), [shift-left](), [terraform]() ### AI overview The article describes using Nirmata Control and its nctl CLI to evaluate Terraform plans against policy-as-code rules before deployment. It presents pre-apply CI checks for detecting infrastructure misconfigurations, including unrestricted ingress, missing S3 public-access blocking, wildcard IAM resources, and missing VPC deployment. ### Source excerpt Run Terraform security scanning on the plan, not the live account. nctl checks 4 critical misconfigs in CI, with exceptions scoped to one resource. ## Provision a secure Amazon DocumentDB cluster with Terraform DevFeed: [Provision a secure Amazon DocumentDB cluster with Terraform]() Original publisher: [Read original article]() Author: Sourav Kundu Published: 2026-08-31T20:24:23Z Content type: tutorial Language: en Sources: [AWS Database Blog]() Topics: [Amazon DocumentDB](), [iac-security](), [Cryptography](), [passwords]() Tags: [advanced-300](), [amazon-cloudwatch](), [amazon-documentdb](), [amazon-vpc](), [authentication](), [encryption](), [infrastructure-as-code](), [monitoring](), [secrets](), [technical-how-to](), [terraform]() ### AI overview A walkthrough for provisioning a secure Amazon DocumentDB 8.0 cluster with Terraform. It applies infrastructure-as-code security controls including private VPC subnets, TLS, KMS encryption, secrets-managed passwords, security groups, and encrypted monitoring logs. ### Source excerpt Learn how to provision a secure Amazon DocumentDB cluster using Terraform. This post applies infrastructure-as-code best practices with encryption, AWS Secrets Manager authentication, network isolation, and encrypted monitoring. ## Troubleshoot and secure your code faster with Datadog's Bitbucket Cloud Source Code integration DevFeed: [Troubleshoot and secure your code faster with Datadog's Bitbucket Cloud Source Code integration]() Original publisher: [Read original article]() Author: Eric Metaj; Mark Azer Published: 2026-08-31T00:00:00Z Content type: article Language: en Sources: [Datadog | The Monitor blog]() Topics: [Developer Tools](), [iac-security](), [Vulnerabilities]() Tags: [apm](), [bitbucket](), [ci-visibility](), [cloud](), [code](), [code-profiling](), [code-security](), [devsecops](), [error-tracking](), [infrastructure-as-code](), [integration](), [observability](), [open-source](), [pull-requests](), [secret-scanning](), [security](), [software-delivery](), [test-optimization](), [vulnerabilities]() ### AI overview Datadog's Bitbucket Cloud Source Code integration links selected repositories with Datadog so teams can investigate production issues with source context and review security findings before merging code. ### Source excerpt Connect Bitbucket Cloud to Datadog to troubleshoot with source code in context and surface test, quality, and security feedback in pull requests. ## Break-glass access for Amazon EKS when federated identity fails DevFeed: [Break-glass access for Amazon EKS when federated identity fails]() Original publisher: [Read original article]() Author: Sam Mukherjee Published: 2026-08-26T16:20:28Z Content type: article Language: en Sources: [Containers]() Topics: [Amazon EKS](), [AWS Identity and Access Management (IAM)](), [Infrastructure as code](), [MFA](), [Authorization](), [iac-security](), [migration]() Tags: [advanced-300](), [amazon-eks](), [amazon-elastic-kubernetes-service](), [aws-iam](), [best-practices](), [identity-and-access-management](), [infrastructure-as-code](), [mfa](), [migration](), [technical-how-to]() ### AI overview This post presents a break-glass access pattern for Amazon EKS clusters when a federated identity provider fails. It describes a dedicated cross-account IAM role with enforced, recency-aware MFA, infrastructure-as-code templates, validation tests, and post-incident recovery procedures. ### Source excerpt Implementing break-glass access for Amazon EKS clusters removes the circular dependency where a federated identity provider outage locks you out of the clusters you need to reach to fix it. This post supplies a cross-account IAM role with enforced MFA, infrastructure-as-code templates, validation tests, and a post-incident recovery procedure. ## Terraform Scalability: When IaC Outgrows Your Setup DevFeed: [Terraform Scalability: When IaC Outgrows Your Setup]() Original publisher: [Read original article]() Author: Mrinalini Sugosh Published: 2026-08-10T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [Terraform](), [Infrastructure as code](), [Scalability](), [iac-security]() Tags: [dynamodb](), [harness](), [iac](), [s3](), [scalability](), [security](), [terraform]() ### AI overview This article examines how Terraform scalability challenges emerge as infrastructure code and teams grow. It discusses bottlenecks involving state management, collaboration, governance, large state files, locking, plan times, module sprawl, and version drift, and introduces Harness IaCM as a management solution. ### Source excerpt Terraform scalability issues slow teams down. Learn how to overcome IaC bottlenecks with better management. See how Harness helps. | Blog ## Install Terraform: Secure & Scalable IaC Setup Guide DevFeed: [Install Terraform: Secure & Scalable IaC Setup Guide]() Original publisher: [Read original article]() Author: Mrinalini Sugosh Published: 2026-07-24T00:00:00Z Content type: tutorial Language: en Sources: [Harness Blog]() Topics: [Terraform](), [Infrastructure as code](), [iac-security](), [Scalability](), [Automation](), [Command-line interface]() Tags: [cli](), [guide](), [iac](), [infrastructure-as-code](), [install](), [scalability](), [security](), [terraform]() ### AI overview A guide to installing Terraform across platforms with security hardening and scalability in mind. It covers installation, configuration, state management, secret handling, version control, team workflows, and production-oriented infrastructure automation. ### Source excerpt Learn to install Terraform with security and scalability built in. Master IaC automation setup from start to finish. See how Harness helps. | Blog ## Privilege separation and the validation loop: The two controls that make AI agents safe in regulated industries DevFeed: [Privilege separation and the validation loop: The two controls that make AI agents safe in regulated industries]() Original publisher: [Read original article]() Author: Eric Paulsen Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [Security](), [Architecture & Design](), [Developer Platform](), [internal developer platform](), [iac-security](), [prompt injection](), [CI/CD](), [IAM](), [Kubernetes](), [YAML]() Tags: [ai](), [ai-agents](), [ci-cd](), [compliance](), [developer-platform](), [governance](), [iam](), [infrastructure-as-code](), [internal-developer-platform](), [kubernetes](), [prompt-injection](), [security]() ### AI overview The article argues that regulated organizations can deploy useful AI agents safely by combining privilege separation with validation loops into one governance system. It assigns platform teams responsibility for the execution environment, including internal developer platforms, CI/CD pipelines, and policy enforcement, while highlighting risks such as hallucinations, excessive IAM permissions, and prompt injection. ### Source excerpt How platform teams can safely deploy AI agents in regulated industries. Unifying privilege separation and the validation loop creates a single governance system that satisfies security and compliance ## Why repository-centric security still needs an artifact access control plane DevFeed: [Why repository-centric security still needs an artifact access control plane]() Original publisher: [Read original article]() Author: Adrian Herrera Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [supply-chain-security](), [CI/CD](), [Security](), [Authorization](), [iac-security]() Tags: [access-control](), [ci-cd](), [infrastructure-as-code](), [security](), [security-policies](), [software-supply-chain](), [vulnerability](), [vulnerability-scanning]() ### AI overview The article explains that repository-centric security controls can leave gaps because dependency access is distributed across CI runners, ephemeral build agents, public registries, developer tooling, and automation. It argues for an artifact access control plane, including Virtual Registries, to enforce security policies inline across CI/CD execution paths, complementing repository-based vulnerability scanning, license analysis, dependency governance, and remediation. ### Source excerpt Repository security gaps: Distributed dependency access bypasses centralized analysis. Virtual Registries offer the critical inline control plane to enforce artifact security policies across your CI/CD pipeline. ## Why Database DevOps Matters in Modern Software Delivery DevFeed: [Why Database DevOps Matters in Modern Software Delivery]() Original publisher: [Read original article]() Author: Jesse Wang Published: 2026-07-17T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [Databases](), [Infrastructure as code](), [DevOps](), [Database Migration](), [iac-security](), [Provisioning](), [Platform Engineering](), [Terraform](), [AWS CloudFormation]() Tags: [aws-cloudformation](), [database](), [deployment](), [devops](), [infrastructure](), [infrastructure-as-code](), [migrations](), [platform-engineering](), [software-delivery](), [terraform]() ### AI overview The article explains that Infrastructure as Code improved infrastructure provisioning but did not address database schema change delivery. It argues that separating infrastructure, application, and database workflows creates operational risk, and presents Database DevOps as a way to bring version control, rollback, and governance to database delivery. ### Source excerpt Infrastructure as Code transformed infrastructure delivery. Learn why database delivery requires a different approach and how Database DevOps closes the gap. | Blog ## How Snyk Helps Federal Agencies Prepare for the Genesis Mission Era of AI-Driven Science DevFeed: [How Snyk Helps Federal Agencies Prepare for the Genesis Mission Era of AI-Driven Science]() Original publisher: [Read original article]() Author: Phoebe Nerdahl Published: 2025-12-09T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [iac-security](), [CI/CD]() Tags: [ai](), [awareness](), [blog](), [ci-cd](), [cloud](), [container-security](), [containers](), [cybersecurity](), [data](), [datasets](), [developers](), [executive](), [government](), [iac-security](), [infrastructure-as-code](), [open-source](), [open-source-security](), [research](), [science](), [security](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [software](), [supply-chain]() ### AI overview Snyk explains how federal agencies can secure AI-driven scientific software, data pipelines, cloud resources, and software supply chains for the Genesis Mission. ### Source excerpt Snyk helps Federal Agencies secure software for the White House's Genesis Mission, accelerating AI-driven science. Implement Secure by Design for the supply chain, cloud, and pipelines. ## How Hugging Face Scaled Secrets Management for AI Infrastructure DevFeed: [How Hugging Face Scaled Secrets Management for AI Infrastructure]() Original publisher: [Read original article]() Author: Thomas Segura Published: 2025-03-31T00:00:00Z Content type: article Language: en Sources: [Hugging Face - Blog]() Topics: [migration](), [iac-security](), [incident]() Tags: [ai-infrastructure](), [automation](), [aws](), [azure](), [case-study](), [cloud](), [gcp](), [hugging-face](), [incident](), [infra](), [infrastructure-as-code](), [kubernetes](), [migration](), [partnerships](), [secrets](), [security](), [terraform]() ### AI overview A case study of Hugging Face migrating secrets management to Infisical for a multi-cloud infrastructure. It covers secret sprawl, RBAC and SSO needs, local-development workflows, secret rotation, Terraform, and Kubernetes secret updates. ### Source excerpt We're on a journey to advance and democratize artificial intelligence through open source and open science. ## DevSecOps Automation Framework DevFeed: [DevSecOps Automation Framework]() Original publisher: [Read original article]() Author: Ben Desjardins Published: 2025-03-11T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [DevSecOps](), [Automation](), [Framework](), [Application Security](), [Testing](), [CI/CD](), [iac-security](), [Vulnerabilities]() Tags: [application-security](), [automation](), [awareness](), [blog](), [ci-cd](), [devops](), [devsecops](), [executive](), [framework](), [iac-security](), [infrastructure-as-code-iac](), [megawatt](), [security](), [snyk-platform](), [vulnerabilities]() ### AI overview This article explains how DevSecOps automation integrates security throughout the software development lifecycle. It discusses automation frameworks, automated security testing in CI/CD pipelines, early vulnerability detection, consistent security policies, compliance, SAST, and Infrastructure as Code security. ### Source excerpt Learn about the principles of DevSecOps automation, how to implement a DevSecOps automation strategy, & the best DevSecOps tools. ## 5 reasons why developers at FinServ institutions are outpacing their security teammates DevFeed: [5 reasons why developers at FinServ institutions are outpacing their security teammates]() Original publisher: [Read original article]() Author: Katie DeMatteis Published: 2024-09-09T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security](), [iac-security](), [Vulnerabilities]() Tags: [ai](), [application-security](), [awareness](), [blog](), [ci-cd](), [cloud](), [devops](), [enablement](), [executive](), [finserv](), [iac-security](), [infrastructure-as-code](), [megawatt](), [vulnerabilities]() ### AI overview Financial-services development teams are adopting new technologies and cloud-based infrastructure-as-code quickly, while security teams struggle to adapt older application-security tools and processes to these environments. ### Source excerpt Learn why the development practices at financial services companies are outpacing older security technologies and techniques. ## Automate security controls from development to production on Google Cloud DevFeed: [Automate security controls from development to production on Google Cloud]() Original publisher: [Read original article]() Author: David Lugo Published: 2024-06-18T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security](), [iac-security](), [open-source-security]() Tags: [ai](), [application-security](), [awareness](), [blog](), [containers](), [developer](), [devops](), [devsecops](), [enablement](), [google](), [google-cdm](), [google-cloud](), [infrastructure-as-code](), [interest](), [megawatt](), [open-source](), [related-content](), [sdlc](), [security](), [workflows]() ### AI overview Snyk describes integrating its application security tooling with Google Cloud to automate security controls throughout cloud-native development workflows. ### Source excerpt Learn how Snyk's developer-first application security tooling can support development teams in securing their development workflows on Google Cloud. ## Enhancing code to cloud security with the Common Configuration Scoring System DevFeed: [Enhancing code to cloud security with the Common Configuration Scoring System]() Original publisher: [Read original article]() Author: Wayne Crissman; Tal Dromi Published: 2023-12-14T14:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [iac-security](), [snyk-iac](), [Infrastructure as code](), [configuration](), [Application Security](), [sdlc](), [Security]() Tags: [application-security](), [aspm](), [awareness](), [blog](), [cloud-security](), [code-security](), [configuration](), [developer](), [engineering](), [iac](), [infrastructure-as-code](), [metrics](), [nist](), [sdlc](), [security](), [security-rules](), [snyk](), [snyk-security-intel](), [standards]() ### AI overview Snyk is standardizing its code-to-cloud security rules on the Common Configuration Scoring System (CCSS). The change applies to Snyk Infrastructure as Code (IaC), IaC+, and cloud configurations, using technical severity, threat intelligence, and application and business context to produce clearer risk assessments. ### Source excerpt To eliminate this burden and provide our customers with a clear security assessment for configurations across the SDLC, Snyk will be moving towards standardizing our code to cloud security rules set on the Common Configuration Scoring System (CCSS)! ## Introducing the Snyk App for Compass: A complete view of software component risk DevFeed: [Introducing the Snyk App for Compass: A complete view of software component risk]() Original publisher: [Read original article]() Author: LaToya Muff Published: 2023-10-05T05:00:00Z Content type: release Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Vulnerabilities](), [Application Security](), [iac-security](), [snyk-iac](), [container-security](), [Developer Tools]() Tags: [acquisition](), [app](), [application-security](), [aspm](), [atlassian](), [awareness](), [blog](), [container-security](), [devops](), [infrastructure-as-code](), [integration](), [related-content](), [security](), [snyk-code](), [snyk-container](), [snyk-open-source](), [snyk-platform](), [sre](), [toolchain](), [vulnerabilities]() ### AI overview Snyk announces its Compass integration, which brings vulnerability data and security metrics into the Compass component catalog to help teams identify critical and high-severity risks. ### Source excerpt Snyk is proud to offer the first security integration for Compass. The new Snyk App for Compass connects vulnerability data to help teams track critical and high-severity vulnerabilities that put applications at risk. ## Snyk Partner Speak video series with HashiCorp DevFeed: [Snyk Partner Speak video series with HashiCorp]() Original publisher: [Read original article]() Author: Sarah Conway Published: 2023-10-04T05:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [iac-security]() Tags: [application-security](), [automation](), [awareness](), [blog](), [cloud](), [cloud-infrastructure](), [deployment](), [developer](), [devops](), [executive](), [iac-security](), [infrastructure-as-code](), [partnership](), [related-content](), [security](), [series](), [snyk-iac](), [terraform](), [video](), [vulnerability](), [workflows]() ### AI overview Snyk and HashiCorp present a video about integrating security into development and deployment workflows. The partnership applies Snyk scanning and remediation to Terraform Cloud workflows to identify and fix infrastructure-as-code misconfigurations before production. ### Source excerpt The latest Snyk Partner Speak Series video showcases how Snyk and HashiCorp enable development teams to easily build and deploy applications with integrated security at every stage. ## Announcing IaC+ early access: Secure your infrastructure configurations across the SDLC DevFeed: [Announcing IaC+ early access: Secure your infrastructure configurations across the SDLC]() Original publisher: [Read original article]() Author: Lauren Place Published: 2023-10-03T13:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [iac-security](), [snyk-iac](), [Infrastructure as code](), [snyk](), [sdlc](), [Terraform](), [ide](), [ci](), [Command-line interface](), [Monitoring]() Tags: [acquisition](), [blog](), [ci](), [ci-cd](), [cli](), [cloud-security](), [compliance](), [convert-paid](), [devops](), [enablement](), [executive](), [iac](), [iac-security](), [ide](), [monitoring](), [pmm](), [preview](), [sdlc](), [security](), [snyk](), [snyk-iac](), [terraform]() ### AI overview Snyk announces IaC+, an early-access version of Snyk IaC available through Snyk Preview from October 3, 2023. It is designed to help developers find and fix infrastructure misconfigurations across the SDLC, from code to cloud, with improved pre-deployment analysis, broader security and compliance rules, and support for multi-file Terraform analysis. ### Source excerpt We're excited to announce that IaC+ is available in early access via Snyk Preview starting October 3rd, 2023.