The problem IAM wildcards and public S3 buckets keep slipping through Terraform code review. Tools...
The problem
IAM wildcards and public S3 buckets keep slipping through
Terraform code review. Tools like Checkov and tfsec exist
but they live in CI, require config files, and developers
ignore the output because it's not where they're working.
TL;DR: Application code isn't the only thing that ships vulnerabilities — your Terraform does too. I...
Terraform had a blind spot in my three-tier project. The code could create the infrastructure. The...
Introduction Security issues in cloud infrastructure often start as small configuration...
Abstract Application code isn't the only place a SAST tool belongs — infrastructure...
Static analysis isn't just for application source code. Terraform, Pulumi, OpenTofu, and...
Abstract Infrastructure as Code (IaC) has turned cloud infrastructure into source code —...
