DevSecOps › Module 6 › Lesson 1
IaC Threats
IaC threat literacy — misconfiguration, overly permissive IAM, state exposure, drift, secret leakage — named rows on YOUR `$DEVSEC_LAB` Terraform stubs only.
Visual · t36_iac_threats
IaC threats = named misconfig rows. $DEVSEC_LAB. Original Cyberlium.
Opening
Cloud breaches often start in Terraform — name IaC threat categories on YOUR lab stubs before scanning stranger org repos or prod without ticket.
IaC threat literacy names: misconfiguration category (public bucket, open SG literacy stub), overly permissive IAM category, state file exposure category, configuration drift category, and secret-in-code leakage category. Analyst documents IaC threat card on `$DEVSEC_LAB` self-authored Terraform stub — maps each threat row to Module 5 pipeline hygiene — without scanning employer prod accounts without authorization, without cloning stranger org IaC repos, without pipeline sabotage recipes against third-party CI. Cyberlium teaches shift-left IaC vocabulary on YOUR labeled notes under $HOME/cyberlium-lab/t36-devsec/ — defender literacy only. Refused: stranger org IaC scans, prod deploy without ticket, weaponized pipeline tampering. Lab row: IaC threat card (five threat rows, stub resource link, mitigation literacy stub). chmod 600.
1. Named IaC threat rows
Misconfiguration, permissive IAM, state exposure, drift, secret leakage — five literacy anchors.
Each row cites YOUR lab Terraform stub — not generic cloud breach blog advice.
Command guide
Try these commands — Named IaC threat rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
GitHub Actions security — https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions Gitleaks — https://gitleaks.io/ Aqua Trivy — https://aquasecurity.github.io/trivy/ Bridgecrew Checkov — https://www.checkov.io/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
curl -sS https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions | head -10
cat > "$DEVSEC_LAB/notes/github-actions-security.txt" <<'EOF'
GitHub Actions security hardening — NAMED LITERACY:
Pin actions to full commit SHA — not @main
Least-privilege GITHUB_TOKEN permissions
OIDC to cloud — avoid long-lived cloud keys in secrets
Separate env secrets from vars; never log secrets
security.yml: gitleaks + checkov + trivy steps on YOUR repo
Lab stub in sample-repo/.github/workflows/security.yml — not live prod org
EOFCommand — copy this
grep -E 'SHA|gitleaks|security.yml|YOUR' "$DEVSEC_LAB/notes/github-actions-security.txt"
Primary tools to practice this lesson: curl, grep. Reference sites: GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions); Gitleaks (https://gitleaks.io/); Aqua Trivy (https://aquasecurity.github.io/trivy/); Bridgecrew Checkov (https://www.checkov.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Shift-left link
IaC threats surface before runtime — link Module 3 pipeline stage rows.
Threat card feeds Checkov scan scope from Module 6-3 — same stub thread.
3. $DEVSEC_LAB boundary
IaC notes from YOUR authorized lab repos only — not stranger org pipelines.
Refused: prod account scans without ticket, stranger IaC clones, pipeline sabotage recipes.
4. What you ship: IaC threat card
Five threat rows + stub resource link + mitigation stub + NEVER stranger org IaC scan line.
5. What you record before the next lesson
IaC threat card path.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Clone stranger org Terraform repo from public leak dump as 'IaC threat research' without authorization.
Right
IaC threat card from `$DEVSEC_LAB` Terraform stub. Next: Terraform Hygiene.
Mission: IaC threat card
1) Name five IaC threat literacy rows. 2) Map each to a lab stub resource. 3) Mitigation literacy stub per row. 4) Write NEVER stranger org IaC scan line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Misconfig vs drift — literacy split on lab stub?”
Knowledge Check
APPLY: IaC threat literacy on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Stranger org IaC scans belong in DevSec lab.
True or False
Knowledge Check
APPLY: IaC threat card includes:
Multiple choice