Résumé
ONYEDIKACHI BERNARDCLOUD · DEVSECOPS · AI
RésuméGet in touch
CASE 32INFRASTRUCTURE AS CODE

Terraform Cloud IaC Hardening

A Terraform configuration granted EC2FullAccess, used an admin instance profile, and had no network filtering or monitoring. I replaced it with least-privilege IAM, a scoped security group, a service-account profile, VPC Flow Logs, and CloudTrail.

Status: HARDENED · VERIFIED

DOMAIN
Infrastructure as Code
PLATFORM
Terraform, AWS
SEVERITY
High
OUTCOME
Least privilege and monitoring

TOOLS

TerraformAWS IAMAWS VPCAWS Security GroupsAWS Auto ScalingAWS VPC Flow LogsAWS CloudTrailInfrastructure as Code
RESULT
BEFOREFull access, no monitoring
AFTERScoped IAM, SG, Flow Logs, CloudTrail
01

Objective

I set out to identify security weaknesses in a Terraform configuration and apply appropriate cloud security controls, including least-privilege IAM permissions, network filtering, secure instance profiles, and monitoring.

02

Scenario

A Terraform configuration was used to provision AWS infrastructure, but it contained several insecure defaults. The IAM policy granted AmazonEC2FullAccess, the instance profile used an admin-level role, and there were no security groups, VPC Flow Logs, or CloudTrail configured. I wanted to harden the configuration before it was applied.

03

What I found

iam-configEXCESSIVE PERMS
IAM policy:          AmazonEC2FullAccess
Instance profile:    admin_profile
Scope:               All EC2 actions on all resources
FINDING 01HIGH

Excessive IAM permissions

The Terraform configuration attached AmazonEC2FullAccess to the EC2 instances, granting far more permissions than the workload required.

network-configNO CONTROLS
Security group:      Not configured
VPC Flow Logs:       Not configured
CloudTrail:          Not configured
SSH access:          Unrestricted
FINDING 02HIGH

No network filtering or monitoring

The configuration had no security group to control inbound or outbound traffic, and neither VPC Flow Logs nor CloudTrail were configured for visibility.

04

What I did

  1. Reviewed the Terraform configuration

    I identified the insecure IAM policy, admin instance profile, and missing network and monitoring controls.

  2. Replaced the IAM policy

    I changed AmazonEC2FullAccess to AmazonEC2ReadOnlyAccess to apply least-privilege permissions.

  3. Added a security group

    I configured inbound SSH restrictions and outbound traffic controls.

  4. Changed the instance profile

    I replaced admin_profile with service_account_profile to scope the instance identity.

  5. Enabled monitoring

    I added VPC Flow Logs and CloudTrail to the Terraform configuration.

  6. Applied and validated

    I completed the Review, Implement, and Destroy phases of the IaC exercise.

EVIDENCE

TEXT
# Terraform hardening summary
IAM policy:          AmazonEC2FullAccess → AmazonEC2ReadOnlyAccess
Instance profile:    admin_profile → service_account_profile
Security group:      Added (SSH + outbound controls)
VPC Flow Logs:       Enabled
CloudTrail:          Enabled
05

Validation

The hardened Terraform configuration was applied successfully. The infrastructure was provisioned with least-privilege IAM, a scoped security group, a service-account instance profile, and both VPC Flow Logs and CloudTrail for monitoring.

06

Before and after

CONTROLBEFOREAFTER
IAM policyAmazonEC2FullAccessAmazonEC2ReadOnlyAccess
Instance profileadmin_profileservice_account_profile
Security groupNot configuredSSH and outbound controls
VPC Flow LogsNot configuredEnabled
CloudTrailNot configuredEnabled
07

What I recommend

  1. 01Apply least-privilege IAM policies in Terraform configurations; never use FullAccess managed policies for workloads.
  2. 02Use service-account instance profiles instead of admin-level profiles.
  3. 03Include security groups in every Terraform deployment to control network access.
  4. 04Enable VPC Flow Logs and CloudTrail in every environment for visibility and incident response.
  5. 05Review and scan Terraform configurations for security issues before applying them, using tools like tfsec or Terraform Sentinel policies.

“Terraform can consistently deploy both secure and insecure infrastructure, so IaC configurations must undergo security review before they are applied to cloud environments.”

WHAT I LEARNED

SKILLS IT PROVES

  • Terraform
  • Infrastructure as Code Security
  • AWS Cloud Security
  • IAM
  • Least Privilege
  • VPC Security
  • Security Groups
  • CloudTrail
  • VPC Flow Logs
  • Security Hardening
  • Security Monitoring
  • Access Control
  • DevSecOps
  • Cloud Infrastructure Security
View my labs on GitHub