Iac security

IaC Security

Scan infrastructure-as-code for misconfigurations for "$ARGUMENTS". Identify IaC tools in use, detect common security misconfigurations, and establish policies for secure infrastructure provisioning.

Prerequisites

Read .metapowers/security/$ARGUMENTS/00-govern.md. If this file does not exist, tell the user:

Phase 0 (Govern) has not been completed for "$ARGUMENTS". Run a Govern skill first (e.g., /security:security-policy $ARGUMENTS), or use --skip-checks to bypass.

If --skip-checks is present in $ARGUMENTS, skip this check and log to .metapowers/security/$ARGUMENTS/skip-log.md.

Process

1. Identify IaC tools and scope:

   • Catalog IaC tools in use (Terraform, CloudFormation, Pulumi, Helm, Ansible, CDK)
   • Identify all IaC files and modules (root modules, shared modules, Helm charts)
   • Determine cloud providers targeted (AWS, Azure, GCP, multi-cloud)
   • Assess current IaC review and approval process

2. Scan for common misconfigurations:

   • Storage — public S3 buckets, unencrypted storage volumes, missing access logging
   • Network — open security groups (0.0.0.0/0 on sensitive ports), missing network ACLs, public subnets for internal resources
   • Encryption — unencrypted RDS instances, missing KMS key usage, unencrypted EBS volumes
   • IAM — overly permissive IAM policies (Action: *, Resource: *), missing MFA enforcement, wildcard permissions
   • Logging — disabled CloudTrail, missing VPC flow logs, no access logging on S3 buckets
   • Compute — public-facing instances with SSH open, missing patching configuration, default security groups

3. Select and configure scanning tools:

   • Evaluate scanning tools (Checkov, tfsec, Bridgecrew, KICS, Terrascan, Snyk IaC)
   • Configure tool with custom policies matching organizational security requirements
   • Tune rules to reduce false positives while maintaining coverage
   • Generate baseline scan results for current IaC

4. Define IaC security policies:

   • Create policy-as-code rules for mandatory security controls
   • Define severity levels and enforcement (block deploy for critical, warn for medium)
   • Establish exception process for intentional deviations (documented, time-limited, approved)
   • Create approved module library for common patterns (VPC, database, compute) with security built in

5. Integrate scanning into CI/CD:

   • Add IaC scanning as a required CI check before merge
   • Configure plan-time scanning (catch issues before apply)
   • Set up drift detection (compare deployed state against IaC definition)
   • Define remediation SLAs by severity (critical: 24 hours, high: 1 week, medium: 1 sprint)

6. Create remediation guidance:

   • Document fix for each common misconfiguration type
   • Provide secure-by-default code snippets and module templates
   • Create developer documentation for writing secure IaC
   • Establish peer review requirements for IaC changes

7. Write the artifact to .metapowers/security/$ARGUMENTS/02-protect.md with heading:

   IaC Security

   Include sections:

   • IaC Inventory — tools, modules, and cloud providers in use
   • Misconfiguration Findings — all findings categorized by type and severity
   • Scanning Tool Configuration — selected tools, custom policies, and tuning
   • Security Policies — policy-as-code rules and enforcement levels
   • CI/CD Integration — pipeline integration and drift detection plan
   • Remediation Guide — fixes and secure templates per finding type

Output

The IaC security scan written to .metapowers/security/$ARGUMENTS/02-protect.md. Present a summary to the user highlighting:

• Total misconfigurations found by category and severity
• Most critical findings requiring immediate remediation
• Scanning tool and CI/CD integration plan
• Secure module templates available for reuse