Infrastructure as code

Choose and evaluate application security testing tools

What SAST, DAST, IAST, SCA, secrets, IaC, container and API scanners and ASPM each find and miss, where each runs, how to evaluate them on a seeded repository with per-CWE scoring and triage cost, and which to adopt first.

Testing, Maintenance, Security program · AppSec engineers, Platform engineers and SREs, Security leaders

Review infrastructure changes as access changes

Inspect the effective permissions, exposure, sensitive state, and recovery implications of a proposed infrastructure change.

Release, Maintenance · Developers, Platform engineers and SREs

Review cloud permissions and role trust together

Distinguish who can obtain a cloud identity from what that identity can do, then test the effective access path.

Release, Maintenance · Developers, Platform engineers and SREs

Test infrastructure policy and detect security-relevant drift

Connect source configuration, the proposed plan and deployed resources so a safe review does not become stale after deployment.

Release, Maintenance · Developers, Platform engineers and SREs

Prevent subdomain takeover from dangling DNS records

A DNS record that outlives its cloud resource lets whoever claims the name serve content on your domain. Bind records to resources in IaC, remove the record first, verify domains and scan for dangling records.

Release, Maintenance · Platform engineers and SREs

Apply a security baseline across AWS, Azure and Google Cloud

Give workloads platform identities instead of keys, guard the instance metadata endpoint, block public storage, keep audit logs past the default retention, close inbound admin ports and use the native secret store, with tested Terraform for AWS, Azure and Google Cloud.

Release, Maintenance · Developers, AppSec engineers, Platform engineers and SREs

Authorization models: RBAC, ABAC, ReBAC and policy as code you can test

Translate roles, attributes and relationships into explicit subject-action-resource decisions, prevent broken object level authorization (BOLA), and verify ownership and tenant boundaries with tests.

Design, Development · Developers

IAM trust policy lab: Evaluate a role trust policy against the confused deputy

An evaluator for AWS sts:AssumeRole trust policies matches the principal and action but ignores the Condition block and does not honour an explicit Deny, so a broad principal can assume a role without the external id — the confused deputy. Repair evaluate_trust to enforce conditions and Deny.