IaC Security & Compliance Language

tfsec (now integrated into Trivy as trivy config) is a static analysis security tool (SAST) for Terraform configurations. It detects misconfigurations before any infrastructure is deployed.

• IaC SAST — static application security testing applied to infrastructure code
• shift-left security — catching misconfigurations in PRs rather than discovering them in production
• misconfigurations as code — the class of vulnerabilities where the infrastructure definition itself is the security flaw

Policy as code transforms governance from static documents into executable, version-controlled, automatically enforced rules:

• Hard enforcement — policy blocks deployment; cannot be bypassed
• Soft enforcement — policy logs violations or notifies but does not block
• Policy guardrails in CI — automated checks in the pipeline before code reaches production

Terraform Sentinel has three enforcement levels with different compliance implications:

• Policy override — the mechanism allowing authorised exceptions to soft-mandatory policies, typically with an audit log entry
• Compliance gate — a checkpoint in the deployment pipeline that requires policy checks to pass before proceeding
• Break-glass — emergency override procedures for time-critical situations that bypass normal controls

S3 access logging records every request to the bucket (GET, PUT, DELETE operations) including: requester IP address, timestamp, HTTP status code, bytes transferred, and object key accessed.

• S3 access logs vs. CloudTrail — CloudTrail records AWS API calls (e.g. creating a bucket); S3 access logs record object-level operations (e.g. downloading a file) — both are often required for full audit coverage
• CKV check identifiers — checkov uses IDs like CKV_AWS_18 to identify specific policy checks, enabling suppression of false positives in .checkov.yaml

This is the environment promotion with RBAC pattern — a core principle of mature IaC workflows.

• environment promotion — changes flow through environments in sequence (dev → staging → prod) before reaching production
• immutable production changes — only reviewed, pipeline-executed changes reach production, never ad-hoc manual applies
• CI/CD service account scoping — the service account has only the IAM permissions needed for production Terraform, not full admin access
• break-glass procedures — documented emergency process for production access if CI/CD is unavailable