Security automation with IaC

conftest /usr/local/bin - name: Run OPA Policies run: conftest test infra/ --policy policies/ --fail-on-warn - name: CDK Security Scan run: | npm ci npx cdk synth npx cdk-nag infra/lib/*.ts

### Step 3: Implement Drift Detection
IaC security automation fails when it only validates code, not state. Run scheduled drift detection against cloud APIs. Compare actual resource configurations against the IaC model. Flag deviations that bypass the pipeline.

TypeScript drift checker using AWS SDK v3:

```typescript
import { S3Client, GetBucketEncryptionCommand } from '@aws-sdk/client-s3';

async function verifyBucketEncryption(bucketName: string): Promise<boolean> {
  const client = new S3Client({ region: process.env.AWS_REGION });
  try {
    const cmd = new GetBucketEncryptionCommand({ Bucket: bucketName });
    const res = await client.send(cmd);
    return res.ServerSideEncryptionConfiguration !== undefined;
  } catch {
    return false; // Bucket lacks encryption or doesn't exist
  }
}

Step 4: Enforce Automated Remediation

Drift detection must trigger remediation, not just alerts. Use state-machine workflows to auto-remediate low-risk violations (e.g., missing tags, disabled public access). High-risk violations (e.g., open security groups, disabled logging) require manual approval with pre-filled remediation PRs.

Architecture rationale: Pre-provisioning gates prevent violations from entering the environment. Drift detection catches out-of-band changes. Automated remediation closes the loop without engineering overhead. This triad eliminates the traditional security bottleneck while maintaining auditability. Every policy evaluation, drift scan, and remediation action is logged, versioned, and tied to a specific commit SHA.

Pitfall Guide

1. Treating IaC Scans as Compliance Completion Running a scanner once per sprint creates a false sense of security. Policies change, cloud services evolve, and new violation patterns emerge. Scanning must be continuous, tied to every commit, and versioned alongside infrastructure code.

2. Blindly Adopting Default Rule Sets Out-of-the-box policies (CIS, NIST, AWS Foundational) are starting points, not endpoints. They generate noise when applied without environment context. Tune severity thresholds, suppress known exceptions with documented justifications, and enforce mandatory rules only.

3. Ignoring Runtime Drift IaC security automation that only validates code misses console changes, CLI bypasses, and third-party integrations. Drift detection must run post-deployment and correlate actual state with desired state. Without this, automation only secures the pipeline, not the environment.

4. Hardcoding Secrets in IaC Templates Embedding credentials, API keys, or private keys in Terraform variables, CDK context, or Pulumi configs breaks security automation. Use secret managers (AWS Secrets Manager, HashiCorp Vault) with dynamic credential generation. IaC should reference secrets, never contain them.

5. Bypassing Gates for "Urgent" Deployments Emergency overrides destroy policy integrity. Implement break-glass workflows with mandatory post-deployment reviews, automated rollbacks, and audit trails. If gates are consistently bypassed, the policies are misaligned with operational reality.

6. Lack of Role-Based Policy Enforcement Applying identical rules to development, staging, and production creates friction. Use environment-aware policy evaluation. Allow relaxed networking in dev, enforce strict isolation in prod, and require explicit approvals for cross-environment promotions.

7. Not Versioning Policies Alongside Infrastructure Policies that live in a separate repository or static dashboard create drift between intent and enforcement. Store policies in the same monorepo as IaC. Use Git hooks to validate policy syntax before commit. Treat policy updates as infrastructure changes.

Best Practices from Production:

• Run policy evaluation in isolated containers to prevent dependency conflicts.
• Cache policy engines in CI to reduce pipeline latency below 15 seconds.
• Use policy suppression files with mandatory expiration dates to prevent permanent exceptions.
• Implement policy coverage metrics: track percentage of resources evaluated vs. total deployed.
• Require policy authors to sign commits with GPG/SSH keys for audit integrity.

Production Bundle

Action Checklist

• Policy Definition: Establish baseline rules covering encryption, IAM least-privilege, network isolation, and tag compliance
• CI/CD Integration: Embed policy evaluation gates before plan/synth steps in all infrastructure pipelines
• Drift Detection: Schedule daily state correlation scans against cloud APIs with automated alerting
• Remediation Workflows: Implement auto-remediation for low-risk violations and break-glass approvals for critical ones
• Policy Versioning: Store policies in the same repository as IaC with Git commit signing and changelog tracking
• Environment Segmentation: Apply role-based policy enforcement with relaxed dev rules and strict prod controls
• Audit Trail: Log all policy evaluations, suppressions, and remediations with commit SHA and timestamp correlation

Decision Matrix

Configuration Template

Complete GitHub Actions workflow with OPA policy evaluation, CDK security scan, and drift detection trigger:

name: IaC Security Automation Pipeline
on:
  push:
    paths:
      - 'infra/**'
      - 'policies/**'
  schedule:
    - cron: '0 2 * * *' # Daily drift detection

env:
  AWS_REGION: us-east-1
  CONTEST_POLICY_DIR: policies/
  CDK_APP: infra/lib/main.ts

jobs:
  security-gate:
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 20
      - name: Install Dependencies
        run: npm ci
      - name: Run OPA Policies
        run: |
          curl -L https://github.com/open-policy-agent/conftest/releases/latest/download/conftest_Linux_x86_64.tar.gz | tar -xz
          ./conftest test infra/ --policy ${{ env.CONTEST_POLICY_DIR }} --fail-on-warn
      - name: CDK Security Scan
        run: npx cdk synth && npx cdk-nag ${{ env.CDK_APP }}

  drift-detection:
    if: github.event_name == 'schedule'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Drift Scanner
        run: npx ts-node scripts/drift-checker.ts
      - name: Post Remediation PR
        if: failure()
        uses: peter-evans/create-pull-request@v5
        with:
          commit-message: 'fix: auto-remediate detected drift'
          title: 'Automated Drift Remediation'
          body: 'Pipeline detected configuration drift. Remediation applied.'
          branch: auto/drift-remediation

Quick Start Guide

1. Install cdk-nag and conftest in your infrastructure repository: npm i -D cdk-nag && curl -L https://github.com/open-policy-agent/conftest/releases/latest/download/conftest_Linux_x86_64.tar.gz | tar -xz -C /usr/local/bin
2. Create a policies/ directory with OPA Rego rules enforcing encryption and public access restrictions
3. Add a CI step running conftest test infra/ --policy policies/ --fail-on-warn before your IaC plan/synth command
4. Commit and push; the pipeline will block any merge that violates baseline policies, generating audit logs automatically