What are the main security risks associated with Infrastructure as Code?

The main security risks in IaC include:

• Hardcoded secrets: Storing sensitive information like passwords, API keys, or certificates directly in IaC files
• Overprivileged resources: Creating resources with excessive permissions that violate the principle of least privilege
• Insecure defaults: Using default configurations that may not follow security best practices
• State file exposure: Terraform state files can contain sensitive data and need proper protection
• Version control exposure: Committing sensitive information to repositories
• Drift and compliance: Infrastructure changes outside of IaC can create security gaps
• Supply chain risks: Using untrusted modules or providers

Example of a common mistake:

resource "aws_db_instance" "example" {
  password = "hardcoded_password_123" # Security risk!
  publicly_accessible = true           # Unnecessary exposure
}