Skip to content

Infrastructure as Code Security Cheatsheet / 基础设施即代码安全速查表

Introduction / 介绍

Infrastructure as code (IaC), also known as software-defined infrastructure, allows the configuration and deployment of infrastructure components faster with consistency by allowing them to be defined as a code and also enables repeatable deployments across environments.

基础设施即代码（IaC），也称为软件定义的基础设施，通过将基础设施组件定义为代码，允许更快、更一致地配置和部署基础设施组件，并使跨环境的重复部署成为可能。

Security best practices / 安全最佳实践

Here are some of the security best practices for IaC that can be easily integrated into the Software Development Lifecycle:

以下是一些可以轻松集成到软件开发生命周期的IaC安全最佳实践：

Develop and Distribute / 开发和分发

  • IDE plugins - Leverage standard security plug-ins in the integrated development environment (IDE) which helps in the early detection of potential risks and drastically reduces the time to address any issues later in the development cycle. Plugins such as TFLint, Checkov, Docker Linter, docker-vulnerability-extension, Security Scan, Contrast Security, etc., help in the security assessment of the IaC.
    中文：IDE插件 - 利用集成开发环境（IDE）中的标准安全插件，有助于早期检测潜在风险，并大幅减少在开发周期后期解决问题所需的时间。例如，TFLint、Checkov、Docker Linter、docker-vulnerability-extension、Security Scan、Contrast Security等插件有助于对IaC进行安全评估。
  • Threat modeling - Build the threat modeling landscape earlier in the development cycle to ensure there is enough visibility of the high-risk, high-volume aspects of the code and flexibility to include security throughout to ensure the assets are safely managed.
    中文：威胁建模 - 在开发周期早期构建威胁建模景观，以确保对代码中高风险、高流量方面的可见性足够，并具有在整个过程中包含安全性的灵活性，以确保资产得到安全的管理。
  • Managing secrets - Secrets are confidential data and information such as application tokens required for authentication, passwords, and SSH (Secure Shell) keys. The problem is not the secrets, but where you store them. If you are using a simple text file or SCMs like Git, then the secrets can be easily exposed. Open-source tools such as truffleHog, git-secrets, GitGuardian and similar can be utilized to detect such vulnerable management of secrets. See the Secrets Management Cheat Sheet for more information.
    中文：管理密钥 - 密钥是机密数据和信息的集合，例如用于身份验证的应用程序令牌、密码和SSH（安全壳）密钥。问题不在于密钥，而在于你存储它们的地方。如果你使用简单的文本文件或SCM（源代码管理）工具如Git，那么密钥很容易被暴露。可以使用开源工具如truffleHog、git-secrets、GitGuardian等来检测这种脆弱的密钥管理。更多信息请参阅密钥管理速查表。
  • Version control - Version control is the practice of tracking and managing changes to software code. Ensure all the changes to the IaC are tracked with the right set of information that helps in any revert operation. The important part is that you’re checking in those changes alongside the features they support and not separately. A feature’s infrastructure requirements should be a part of a feature’s branch or merge request. Git is generally used as the source code version control system.
    中文：版本控制 - 版本控制是跟踪和管理软件代码变更的实践。确保所有IaC的变更都使用正确的一组信息进行跟踪，以便在任何回滚操作中提供帮助。重要的是，您需要将这些变更与其支持的功能一起提交，而不是单独提交。功能的基础设施需求应该是功能分支或合并请求的一部分。Git通常用作源代码版本控制系统。

  • Principle of least privilege - define the access management policies based on the principle of least privilege with the following priority items:
    中文：最小权限原则 - 根据最小权限原则定义访问管理策略，以下为优先项：

    • Defining who is and is not authorized to create/update/run/delete the scripts and inventory.
      中文：定义谁有权限创建/更新/运行/删除脚本和清单。
    • Limiting the permissions of authorized IaC users to what is necessary to perform their tasks. The IaC scripts should ensure that the permissions granted to the various resources it creates are limited to what is required for them to perform their work.
      中文：限制授权IaC用户的权限，仅限于执行其任务所必需的。IaC脚本应确保授予其创建的各种资源的权限仅限于它们执行工作所需。

  • Static analysis - Analyzes code in isolation, identifying risks, misconfigurations, and compliance faults only relevant to the IaC itself. Tools such as kubescan, Snyk, Coverity etc, can be leveraged for static analysis of IaC.
    中文：静态分析 - 在隔离状态下分析代码，识别与IaC本身相关的风险、配置错误和合规性故障。可以使用kubescan、Snyk、Coverity等工具进行IaC的静态分析。

  • Open Source dependency check - Analyzes the open source dependencies such as OS packages, libraries, etc., to identify potential risks. Tools such as BlackDuck, Snyk, WhiteSource Bolt for GitHub, and similar can be leveraged for open source dependency analysis of IaC.
    中文：开源依赖项检查 - 分析开源依赖项，如操作系统包、库等，以识别潜在风险。可以使用BlackDuck、Snyk、WhiteSource Bolt for GitHub等工具进行IaC的开源依赖项分析。
  • Container image scan - Image scanning refers to the process of analyzing the contents and the build process of a container image in order to detect security issues, vulnerabilities or potential risks. Open-source tools such as Dagda, Clair, Trivy, Anchore, etc., can be leveraged for container image analysis.
    中文：容器镜像扫描 - 镜像扫描是指分析容器镜像的内容和构建过程，以检测安全漏洞、漏洞或潜在风险的过程。可以使用Dagda、Clair、Trivy、Anchore等开源工具进行容器镜像分析。 CI/CD pipeline and Consolidated reporting - enabling the security checks to be made available in the CI/CD pipeline enables the analysis of each of the code changes, excludes the need for manual intervention, and enables maintaining the history of compliance. Along with consolidated reporting, these integrations enhance the speed of development of a secure IaC codebase. Open-source tools such as Jenkins, etc., can be leveraged to build the CI/CD pipelines, and DefectDojo and OWASP Glue can help in tying the checks together and visualizing the check results in a single dashboard.

CI/CD管道和综合报告 - 在CI/CD管道中启用安全检查，可以分析每次代码变更，无需手动干预，并使合规性历史记录得以维护。结合综合报告，这些集成可以加快安全IaC代码库的开发速度。可以使用Jenkins等开源工具构建CI/CD管道，DefectDojo和OWASP Glue可以帮助将检查关联起来，并在单个仪表板上可视化检查结果。 - Artifact signing - Digital signing of artifacts at build time and validation of the signed data before use protects artifacts from tampering between build and runtime, thus ensuring the integrity and provenance of an artifact. Open-source tools such as TUF helps in the digital signing of artifacts.
中文：工件签名 - 在构建时对工件进行数字签名，并在使用前验证签名数据，以保护工件在构建和运行时免受篡改，从而确保工件的完整性和来源。可以使用TUF等开源工具帮助进行工件的数字签名。

Deploy / 部署

  • Inventory management:
    中文：库存管理：
    • Commissioning - whenever a resource is deployed, ensure the resource is labeled, tracked and logged as part of the inventory management.
      中文：部署 - 每当资源被部署时，确保资源被标记、跟踪并记录在库存管理中。
    • Decommissioning - whenever a resource deletion is initiated, ensure the underlying configurations are erased, data is securely deleted and the resource is completely removed from the runtime as well as from the inventory management.
      中文：退役 - 每当资源删除被启动时，确保底层配置被删除，数据被安全删除，并且资源从运行时以及从库存管理中完全移除。
    • Tagging - It is essential to tag cloud assets properly. During IaC operations, untagged assets are most likely to result in ghost resources that make it difficult to detect, visualize, and gain observability within the cloud environment and can affect the posture causing a drift. These ghost resources can add to billing costs, make maintenance difficult, and affect the reliability. The only solution to this is careful tagging and monitoring for untagged resources.
      中文：标记 - 正确标记云资产至关重要。在基础设施即代码（IaC）操作期间，未标记的资产很可能会产生幽灵资源，这些资源难以检测、可视化和在云环境中获得可观察性，并可能导致配置漂移。这些幽灵资源会增加账单成本，使维护变得困难，并影响可靠性。解决这一问题的唯一方法是仔细标记和监控未标记的资源。
  • Dynamic analysis - Dynamic analysis helps in evaluating any existing environments and services that it will interoperate with or run on. This helps in uncovering potential risks due to the interoperability. Open-source tools such as ZAP, Burp, GVM, etc., can be leveraged for dynamic analysis.
    中文：动态分析 - 动态分析有助于评估现有环境和将与之交互或运行的服务。这有助于揭示由于互操作性而产生的潜在风险。可以借助开源工具如ZAP、Burp、GVM等进行动态分析。

Runtime / 运行时

  • Immutability of infrastructure - The idea behind immutable infrastructure is to build the infrastructure components to an exact set of specifications. No deviation, no changes. If a change to a specification is required, then a whole new set of infrastructure is provisioned based on the updated requirements, and the previous infrastructure is taken out of service as obsolete.
    中文：基础设施不可变性 - 不可变基础设施背后的理念是将基础设施组件构建成精确的规格集。无偏差，无更改。如果需要更改规格，则根据更新的要求提供全新的一组基础设施，并将旧基础设施退役。
  • Logging - Keeping a record is a critical aspect to keeping an eye on risks. You should enable logging - both security logs and audit logs - while provisioning infrastructure, as they help assess the security risks related to sensitive assets. They also assist in analyzing the root cause of incidents and in identifying potential threats. Open-source tools such as ELK, etc., can be leveraged for log analysis.
    中文：日志记录 - 记录是监控风险的关键方面。在提供基础设施时，应启用日志记录 - 包括安全日志和审计日志 - 因为它们有助于评估与敏感资产相关的安全风险。它们还协助分析事件的根本原因，并识别潜在威胁。可以借助开源工具如ELK等进行日志分析。
  • Monitoring - Continuous monitoring assists in looking out for any security and compliance violations, helps in identifying attacks and also provides alerts upon such incidents. Certain solutions also incorporate new technologies like AI to identify potential threats early. Open-source tools such as Prometheus, Grafana, etc., can be leveraged for monitoring of cloud infrastructure.
    中文：监控 - 持续监控有助于发现任何安全和合规违规行为，帮助识别攻击并提供此类事件警报。某些解决方案还集成了如AI等新技术，以提前识别潜在威胁。开源工具如Prometheus、Grafana等可以用于监控云基础设施。
  • Runtime threat detection: Implementing a runtime threat detection solution helps in recognizing unexpected application behavior and alerts on threats at runtime. Open-source tools such as Falco, etc., can be leveraged for runtime threat detection. Certain application such as Contrast (Contrast Community Edition) can also detect OWASP Top 10 attacks on the application during runtime and help block them in order to protect and secure the application.
    中文：运行时威胁检测：实施运行时威胁检测解决方案有助于识别意外的应用程序行为并在运行时发出威胁警报。开源工具如Falco等可以用于运行时威胁检测。某些应用程序如Contrast（Contrast社区版）也可以在运行时检测应用程序上的OWASP Top 10攻击并帮助阻止它们，以保护和确保应用程序的安全。

References / 参考