Terraform Security: Attacking and Defending Infrastructure as Remote Code Execution - Michael McCabe
Michael McCabe
Infrastructure as Remote Code Execution
The talk will focus on research done on Terraform implementations and ways to harden deployments. The talk will cover how Terraform works, how common Terraform security controls are applied, and multiple ways to bypass them and gain further access to environments.
Outline:
How Terraform works
How plan and apply impact security controls
Common security issues
Malicious users
Ways to harden Terraform deployments
Ways to build IAC pipelines with security built in
This talk will introduce people new to Terraform to the concepts and then explain in-depth ways it can be abused and secured.
Bsides Philly 2023