# Iac Security

> Hardening rules for Terraform, CloudFormation, and Pulumi: state, providers, drift, secrets — Applies to: when generating Terraform / Pulumi / CloudFormation; when reviewing IaC changes in PR; when wiring up a new cloud account or workspace

- **Type:** Skill
- **Install:** `agentstack add skill-shieldnet-360-secure-vibe-iac-security`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [ShieldNet-360](https://agentstack.voostack.com/s/shieldnet-360)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [ShieldNet-360](https://github.com/ShieldNet-360)
- **Source:** https://github.com/ShieldNet-360/secure-vibe/tree/main/dist/claude-skills/.claude/skills/iac-security

## Install

```sh
agentstack add skill-shieldnet-360-secure-vibe-iac-security
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Infrastructure-as-Code Security

Hardening rules for Terraform, CloudFormation, and Pulumi: state, providers, drift, secrets

## ALWAYS

- Pin every provider/module to an exact version or a pessimistic constraint (`~> 5.42`); never `>= 0` or unpinned `latest`.
- Configure a **remote backend** with encryption at rest, server-side state locking, and versioning (Terraform: `s3` + DynamoDB lock table with `kms_key_id`; Pulumi: the managed backend or `s3://?kmskey=`; CloudFormation: managed by AWS).
- Encrypt every persistent resource by default with a customer-managed KMS key: S3 buckets, EBS volumes, RDS, EFS, DynamoDB, SQS, SNS, CloudWatch log groups.
- Tag every resource with `owner`, `environment`, `cost-center`, and `data-classification` via a default tags block.
- Run `terraform plan` (or `pulumi preview`, `aws cloudformation deploy --no-execute-changeset`) in CI and require a human approval before `apply` on production stacks.
- Add a drift-detection job that runs daily and opens an issue when actual cloud state diverges from code (Terraform Cloud drift detection, `pulumi refresh`, `cfn-drift-detect`).
- Use IAM Conditions to scope every role: `aws:SourceArn`, `aws:SourceAccount`, `aws:PrincipalOrgID`, and TLS-only access policies on storage.

## NEVER

- Hardcode provider credentials in the code or `.tfvars` (`access_key`, `secret_key`, `client_secret`, `service_account_key`). Use OIDC federation from CI, the provider's instance metadata service, or a secret manager.
- Commit `terraform.tfstate`, `terraform.tfstate.backup`, `.pulumi/`, or any `*.tfvars` containing real secrets. They contain plaintext secrets even if the code references variables.
- Use `local_exec` / `null_resource` to fetch secrets at apply time and stash them in state. State is queryable plaintext by anyone with backend read access.
- Open security groups / firewall rules to `0.0.0.0/0` for ports 22, 3389, 3306, 5432, 1433, 6379, 27017, 9200, 11211 — even for "just dev". Use bastion or VPN.
- Grant `*:*` (wildcard action on wildcard resource) IAM policies. Use `iam:PassRole` with explicit resource ARNs.
- Disable provider TLS verification (`skip_tls_verify`, `insecure = true`).
- Use `count = 0` to "soft-delete" resources you actually want gone — destroy them.

## KNOWN FALSE POSITIVES

- Bastion hosts intentionally exposed on port 22 to the internet with hardened configurations are not the same risk as opening RDS to the world. Document the exception inline.
- Public CloudFront distributions, ALB listeners on 80/443, API Gateways, and Lambda function URLs that *are* meant to be internet-facing.
- Bootstrap resources (the S3 bucket and DynamoDB lock table the backend itself uses) must exist before remote state can; this chicken-and-egg is usually bootstrapped by a one-time `local` backend that's then migrated.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [ShieldNet-360](https://github.com/ShieldNet-360)
- **Source:** [ShieldNet-360/secure-vibe](https://github.com/ShieldNet-360/secure-vibe)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-shieldnet-360-secure-vibe-iac-security
- Seller: https://agentstack.voostack.com/s/shieldnet-360
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.