IaC Scanning and CSPM
Tiffin's invoices live in a cloud storage bucket. One Friday a developer changes a Terraform file to make a bucket "easier to share", and on Monday a stranger is downloading invoices. Most cloud breaches are not clever hacks; they are misconfigurations. Two checks, one before and one after, catch almost all of them.
The rule
Scan the plan before it's applied; watch the account after.
Infrastructure as code (IaC) describes cloud resources in files, such as Terraform, CloudFormation or Kubernetes manifests, that are reviewed and applied by the pipeline. Because it is code, it can be scanned like code.
IaC scanning reads those files in the pipeline and flags risky settings before anything is created:
resource "aws_s3_bucket_public_access_block" "invoices" {
bucket = aws_s3_bucket.invoices.id
block_public_acls = false # scanner: public access not blocked
block_public_policy = false
}
resource "aws_security_group_rule" "ssh" {
type = "ingress"
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"] # scanner: SSH open to the whole internet
}The same scanners usually read Kubernetes manifests and Dockerfiles too, so one step in the scan stage covers every kind of infrastructure file in the repository. Like SAST, they point to the exact file and line, which makes the fix obvious to the developer who wrote it.
Typical findings: public storage, databases without encryption, admin ports open to the world, logging switched off, over-broad IAM policies.
Cloud security posture management (CSPM) looks at the live cloud account instead. It continuously compares every real resource with a baseline of secure settings and alerts on anything that breaks it. It catches what the pipeline never sees:
- drift: a setting changed by hand in the console
- shadow resources: things created outside IaC altogether
- new rules in the baseline that old resources now fail
The shortcut
Ask of any cloud risk: "Could it arrive through code, around code, or both?" Through code → IaC scanning in the pipeline. Around code → CSPM. Usually both.
Through code
The Terraform change sets
block_public_policy = false. The IaC scanner in thescanstage fails the build. It never reaches the cloud.
Drills
Answer fast — trust the rule.
When does IaC scanning catch a misconfiguration?
Someone opens a database port to the internet by hand in the console. What catches it?
Which Terraform line should an IaC scanner flag?
CSPM reports drift on a bucket. What is the best fix?
Remember
- Scan the plan before it's applied; watch the account after.
- Through code → IaC scanning; around code → CSPM; usually both.
- Fix drift in code, not only in the console.