Infrastructure-as-Code (IaC) Security Scanning · Hacking Project

Catch cloud misconfigurations in infrastructure code before deployment through automated, policy-driven static analysis embedded in the developer workflow.

**The problem**
Cloud misconfigurations are the leading cause of cloud breaches, and most originate in Terraform, CloudFormation, Kubernetes, or Helm code committed before anything is deployed. Without automated pre-deployment analysis, insecure defaults — public S3 buckets, open security groups, unencrypted volumes, privileged pods — reach production unnoticed. Manual review does not scale to hundreds of IaC changes per week.

**What you'll build**
Build a shift-left IaC security scanning workflow that statically analyzes Terraform/CloudFormation/K8s manifests against a policy library, integrates into pre-commit hooks and CI/CD as a blocking gate, and produces prioritized, remediation-oriented findings. Extend beyond off-the-shelf rules with custom policies (Rego/Checkov custom checks), secret detection in IaC, and graph-based analysis to catch multi-resource risk (e.g., a public LB fronting an unauthenticated service).

**Objective** — Catch cloud misconfigurations in infrastructure code before deployment through automated, policy-driven static analysis embedded in the developer workflow.

**Expected outcome** — An IaC scanning pipeline (pre-commit + CI) with a custom policy set that blocks insecure Terraform/K8s changes and outputs prioritized findings with remediation guidance.

**Difficulty** — Intermediate — accessible with existing scanners, but writing meaningful custom policies and graph-aware checks pushes it toward Advanced.

**Primary category** — DevSecOps / Cloud Security; Secondary = AppSec, Policy-as-Code, CSPM (pre-deploy)

**Security domains** — Primary = DevSecOps; Secondary = Cloud Security, AppSec, Blue Team

**Technical focus** — IaC static analysis, Terraform/CloudFormation/K8s/Helm scanning, custom policy authoring, secret detection, misconfiguration remediation, shift-left security, pre-commit gating, graph-based configuration analysis

**Core technologies** — Languages: HCL/Terraform, YAML, Rego, Python; Frameworks/Libraries: Checkov, tfsec/Trivy, Terrascan, KICS, Kubescape, Conftest/OPA; Security Tools: Gitleaks, Snyk IaC, pre-commit; Cloud/Infra: AWS, Azure, GCP, Kubernetes, Terraform; AI/Data: optional ML prioritization of findings; Databases: SQLite/PostgreSQL for findings history

**Where it's valued** — Any cloud-adopting organization, platform engineering teams, MSSPs, regulated cloud environments, cloud-native startups

**Careers it builds toward** — DevSecOps Engineer, Cloud Security Engineer, Platform Engineer, Infrastructure Security Engineer, AppSec Engineer

**Framework alignment**
• MITRE ATT&CK: Prevents conditions enabling Data from Cloud Storage T1530, Cloud Infrastructure Discovery T1580, Modify Cloud Compute Infrastructure T1578, and Valid Accounts: Cloud Accounts T1078.004 (via least-privilege and hardened config)
• NIST CSF 2.0: Identify, Protect (primary), Govern
• OWASP: A05 Security Misconfiguration, A08 Software & Data Integrity Failures; Kubernetes/IaC misconfiguration guidance
• CIS Controls v8: 4 Secure Configuration of Enterprise Assets & Software, 16 Application Software Security, 3 Data Protection

**Innovation** — Improved Existing Solution — mature scanners exist, but custom policy libraries plus graph-aware, multi-resource risk analysis are where differentiation and job-readiness live. Scores: Innovation 5/10, Startup 5/10, Enterprise-Readiness 8/10, Patent = No.