Security ยท 12 min read

Terraform security basics

Terraform can create privileged cloud infrastructure, so safety belongs in the workflow from the start. Make access, exposure, credentials, and destructive changes visible choices that are reviewed before they reach a cloud account.

A deliberately narrow public HTTPS rule

This is only appropriate when the workload genuinely needs public HTTPS. Other services should use narrower sources and ports.

resource "aws_security_group" "web" {
  name = "web"
  ingress {
    from_port = 443
    to_port = 443
    protocol = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

Protect credentials and state

Use protected authentication mechanisms suited to the environment, such as managed identities or secure secret injection. Never paste long-lived access keys into a training file or repository.

State can reveal resource details and sometimes sensitive values. Encrypt it, restrict access, enable locking, and know how it is backed up.

Least privilege and least exposure

For each network rule and identity permission, ask who needs access, through which protocol, and for what purpose. Permit that path and no broader one.

Private placement is helpful for databases and internal services, but it works alongside security groups, route controls, and identity policies. Security is layered.

Treat a plan as a security review

A plan can reveal unexpected public IPs, broad firewall rules, permission changes, replacements, or deletes. Make those changes obvious in review and stop when the output is surprising.

Automation helps, but an approver still needs to understand the data flow and the identities that can affect a system.

Put it into practice

Review the example ingress rule. Name two resources in a small web architecture that should not accept traffic from the whole internet.

  1. Use managed or short-lived credentials.
  2. Protect remote state.
  3. Grant the least permissions required.
  4. Review public exposure in every plan.