Training Module - Secure Infrastructure as Code (IaC)

This example illustrates training in a context of high infrastructure automation, where human understanding of the mechanisms and limits remains essential.

🎯 Objective

To equip the technical teams to:

• Understand the main security risks in IaC projects;
• Apply requirements IAC-001 to IAC-013 defined in Chapter 08 of the SbD-ToE;
• Integrate security validations and good practices into the infrastructure development and operation lifecycle;
• Reduce the risk of exposure, misconfiguration and drift.

---

📋 Prerequisites

• Familiarity with IaC languages (e.g. Terraform, Bicep, YAML/K8s)
• Previous experience with CI/CD pipelines (execution, review or configuration)
• Basic knowledge of environment segregation and credential management

---

🧪 Session format

Block	Duration	Objective
Introduction	10 min	Context and importance of security in IaC
IaC requirements	20 min	Presentation of the normative requirements and link to real bad practices
Review of an insecure PR	20 min	Practical exercise with detection of flaws and group discussion
Integration with CI/CD	15 min	Demonstration of pipelines with automatic validations (tfsec, OPA, etc.)
Quiz + validation	10 min	Questionnaire with immediate feedback

🔍 This module can be adapted to hands-on workshops with real labs or simulations per stack.

---

📦 Required materials

• Repository with real and simulated examples (Terraform, Bicep, K8s)
• Cheatsheet of tools and commands (tfsec, checkov, driftctl, opa)
• PR templates with mandatory validation sections
• Quick reference for requirements IAC-001 to IAC-013
• Flow diagram of validation and exception management

---

✅ Completion criteria

• Active participation in the session or assisted review of a PR
• Passing the final quiz (minimum 80%)
• Delivery of evidence of the integration of validations into the project pipeline (e.g. PR with tfsec/checkov config)

---

🔁 Integration into the lifecycle

• Inclusion of the module in the mandatory DevOps onboarding training
• Technical backlog tasks: [SEC] Validar plano Terraform com tfsec / [SEC] Adicionar tagging obrigatório
• Link to the formal exceptions process described in the chapter
• Create a card or story such as:
  Como DevOps quero validar todos os PRs de IaC com tfsec e driftctl, para garantir conformidade com os requisitos de IaC.

---

🔗 Cross-references in the SbD-ToE

Chapter	Relevance
Chapter 08 - Secure IaC	Main source of requirements and practices (IAC-001 to IAC-013)
Chapter 07 - Secure CI/CD	Integration with pipelines and isolated executions
Chapter 04 - Architecture	Structural impact of configurations and reusable modules
Chapter 02 - Requirements	Correspondence with the Ch. 02 requirements related to secrets, permissions, segregation

---

📊 Operational good practices

• Include this module as a prior requirement for access to cloud environments or critical pipelines
• Hold quarterly sessions with analysis of the organisation's real IaC errors
• Reinforce the use of PR Clinics focused on infrastructure
• Maintain an internal repository of secure and insecure IaC patterns
• Keep track of changes in tools and continuously adapt the content

---

📌 This module is essential for any team that works on infrastructure as code - whether in the context of provisioning, pipelines or operations. Its application reduces systemic risks and increases the organisation's maturity in managing environments and permissions.