iac-security

---
name: iac-security
description: Guidance for securing Infrastructure-as-Code (Bicep, ARM, Terraform, and ACI/Container) pipelines on Azure — shift-left scanning, policy-as-code, secret hygiene, identity for pipelines, drift detection, and supply chain. Covers Microsoft Defender for Cloud DevOps Security (GitHub / Azure DevOps connectors), Microsoft Security DevOps (MSDO) extension, Bicep linter and template specs, Terraform best practices on Azure (state management, backend hardening, provider versions), Azure Policy as deploy-time and CI-time gate, GitOps with Flux/ArgoCD on AKS, secret scanning and dependency review, signed commits / artifact signing, OIDC federation for pipeline identity (no client secrets), and integration with Defender for Cloud posture. WHEN: IaC security, Bicep security, Terraform Azure security, Defender for Cloud DevOps Security, MSDO, Microsoft Security DevOps, shift-left Azure, policy as code, OIDC GitHub Actions Azure, secrets in IaC, drift detection, signed Bicep, supply chain Azure. DO NOT USE for Kubernetes admission control alone (use defender-for-containers), generic CI/CD design, or app-layer security.
license: MIT
---

# Infrastructure-as-Code Security on Azure

Most cloud breaches now route through misconfigured infrastructure that was provisioned
by code. Hardening the IaC pipeline — Bicep, ARM, Terraform, and the CI/CD that runs
them — moves security left of the deploy: misconfigurations get caught at PR review
instead of in a Defender for Cloud finding three weeks later.

## When to use
Designing or hardening the IaC pipeline (GitHub Actions / Azure DevOps / GitLab) for
Azure, including scanning, policy-as-code, pipeline identity, and supply-chain controls.

**Do not use this skill** for K8s admission control alone (`defender-for-containers`),
general CI/CD architecture, or app-layer security.

## Capability stack

| Layer | Capability |
|---|---|
| **Pipeline identity** | OIDC federation (no client secrets), Workload Identities Premium |
| **Pre-commit / PR-time scanning** | Microsoft Security DevOps (MSDO) Action / Extension; Bicep linter; tflint; checkov; trivy; secret scanning |
| **Policy-as-code gate** | Azure Policy in `Audit` and `Deny` modes at deploy; CI evaluation via `az policy` what-if, Terraform `azapi` policy preview |
| **Posture connect-back** | Defender for Cloud DevOps Security connectors to GitHub / Azure DevOps |
| **Drift detection** | Defender for Cloud, Terraform plan in scheduled CI, GitOps controllers (Flux/ArgoCD) on AKS |
| **Supply chain** | Signed commits, dependency review, artifact signing (Notation/cosign), allowed module registries |

## Approach

1. **Replace pipeline secrets with OIDC federation.** Every modern Azure CI integration
   supports federated workload identity:
   - GitHub Actions → Azure: federated credential on user-assigned MI; no
     `AZURE_CREDENTIALS` JSON secret.
   - Azure DevOps → Azure: Workload Identity federation service connection.
   Pin federated credentials to **specific environments / branches**
   (`environment:prod`, not `repo:org/repo:*`). See `entra-workload-identity`.

2. **Minimum scopes for pipeline identity.** Per-pipeline service principal/MI with
   role assignments at RG / resource scope, not subscription Owner. Use deployment
   stacks (Bicep) for blast-radius containment.

3. **Adopt Microsoft Security DevOps (MSDO) Action / Extension.** Bundles open-source
   scanners (template-analyzer, checkov, terrascan, trivy, bandit, ESLint security)
   plus secret scanning (CredScan). Single integration point; fail PR on critical
   findings.

4. **Bicep specifics.**
   - Use `bicep build` + `bicep lint` in CI.
   - Use **template specs** for shared patterns; version them.
   - Use **deployment stacks** with `denySettings` to prevent humans from drifting
     stack resources outside the pipeline.
   - Use module registries (private ACR or Bicep registry) with signed modules.

5. **Terraform specifics.**
   - **Backend hardening**: state in Azure Storage with private endpoint, Customer
     Lockbox + RBAC scoped, soft-delete + versioning + locking.
   - **Provider version pinning** (~> for minor, exact for security-critical).
   - **`tflint` + `checkov`** in CI; **`tfsec` is deprecated** — replaced by trivy.
   - **`terraform plan` artifact** posted to PR for reviewer; Apply gated on approval.
   - **Drift detection** via scheduled `terraform plan` against current state.

6. **Policy-as-code gate.** Azure Policy in **Deny** mode for non-negotiable controls:
   - No public IP on VMs.
   - Private endpoint required on Storage / SQL / Key Vault.
   - Encryption + diagnostic settings + tags required.
   In CI, run `az deployment what-if` (Bicep/ARM) or evaluate against Policy via
   `Get-AzPolicyComplianceForResource` to surface deny-mode failures **before** apply.

7. **Secret hygiene.**
   - **CredScan / GitHub Advanced Security secret scanning** on every push.
   - **No secrets in `.tfvars` or `parameters.json`** — Key Vault references / GitHub
     Environments / pipeline variable groups marked secret.
   - **Block PRs introducing secrets** (push-protection on).
   - Rotate any historical leak; clean git history is hard, change the secret.

8. **Supply chain.**
   - **Pin module versions** by digest where possible (Bicep registry digests, GitHub
     Action SHA pinning).
   - **Allowed registries**: Azure Policy on subscription to restrict containers /
     Bicep modules to your private registry.
   - **Signed artifacts**: Notation / cosign for container images; verify in admission
     control on AKS (`defender-for-containers`).

9. **Defender for Cloud DevOps Security.** Connect GitHub / Azure DevOps to Defender
   for Cloud:
   - Aggregates IaC findings, secret-scanning results, code scanning, dependency
     vulns into a single Defender for Cloud view.
   - Tagging, ownership, and prioritization same as cloud findings.
   - Track posture trend per repo / per pipeline.

10. **Drift detection.** Even with policy + IaC, drift happens (humans, ClickOps).
    Detect:
    - Defender for Cloud posture findings on resources not produced by the pipeline.
    - Scheduled Terraform plan jobs alerting on non-empty diffs.
    - GitOps (Flux/ArgoCD) reconciliation alerts on AKS clusters.

## Guardrails
- **Don't store cloud credentials as long-lived pipeline secrets.** OIDC federation,
  always.
- **Don't run pipelines as Subscription Owner.** Scope tightly; use deployment stacks
  for containment.
- **Failing PRs only on `critical` is too lenient at maturity.** Move to medium+ once
  baseline noise is tuned out.
- **Bicep `what-if` is not a security review.** It shows changes; security review
  reads them.
- **Terraform state files contain secrets in cleartext.** Backend storage hardening is
  non-negotiable.
- **Don't allow `provider "azurerm" { ... features {} }` to drift unpinned across
  pipelines.** Reproducibility = security.
- **`Audit`-only Azure Policy is necessary but insufficient.** Critical controls need
  `Deny`.
- **Branch protection without required reviewers does not gate IaC merges.** Enforce
  the human review.
- **MSDO doesn't replace per-language linters.** Layer.
- **Defender DevOps Security needs the connector — and an owner per repo.** Otherwise
  findings rot.

## Common anti-patterns
- **"Service principal client secret in GitHub Actions"** — leak fueling most pipeline
  breaches.
- **"Subscription-scope Contributor on the pipeline SP"** — single mistake = whole-sub
  outage.
- **"Skipped what-if; Bicep deploy first to see what breaks"** — production change
  without preview.
- **"Terraform state in default storage account, public endpoint"** — secrets exposed.
- **"Disabled push-protection because 'we have CI scanning'"** — secrets still leak in
  history before CI catches.
- **"Pinned action @ main"** — supply-chain compromise rides through. SHA-pin or tag-
  pin verified.
- **"Terraform with random provider versions"** — same code, different result.
- **"Defender DevOps Security findings nobody owns"** — same as Defender for Cloud
  findings nobody owns.
- **"GitOps reconciliation disabled in prod for stability"** — drift becomes invisible.

## Example prompts
- `Migrate all our GitHub Actions Azure deployments from client-secret service
  principals to OIDC federation with environment-pinned subjects.`
- `Roll out Microsoft Security DevOps in 80 repos with PR-blocking on medium+ severity
  findings.`
- `Connect Azure DevOps and GitHub orgs to Defender for Cloud DevOps Security and
  build the per-repo ownership model.`
- `Harden Terraform backend storage: private endpoint, Customer Lockbox, RBAC, soft-
  delete.`
- `Author Azure Policy deny-mode policies for landing-zone non-negotiables and
  evaluate at PR time before deploy.`
- `Implement Bicep deployment stacks with denySettings for blast-radius isolation in
  production.`
- `Drift detection pipeline: scheduled Terraform plan, Defender for Cloud delta, alert
  routing.`
- `Supply-chain hardening: SHA-pin GitHub Actions, signed Bicep modules in private
  registry, container image signing with cosign.`

## Microsoft Learn
- Defender for Cloud DevOps Security: https://learn.microsoft.com/azure/defender-for-cloud/defender-for-devops-introduction
- Microsoft Security DevOps (MSDO): https://learn.microsoft.com/azure/defender-for-cloud/azure-devops-extension
- Connect GitHub: https://learn.microsoft.com/azure/defender-for-cloud/quickstart-onboard-github
- Connect Azure DevOps: https://learn.microsoft.com/azure/defender-for-cloud/quickstart-onboard-devops
- Bicep deployment stacks: https://learn.microsoft.com/azure/azure-resource-manager/bicep/deployment-stacks
- Bicep template specs: https://learn.microsoft.com/azure/azure-resource-manager/bicep/template-specs
- Workload identity federation (GitHub OIDC): https://learn.microsoft.com/entra/workload-id/workload-identity-federation
- Azure Policy as code: https://learn.microsoft.com/azure/governance/policy/concepts/policy-as-code
- Terraform on Azure best practices: https://learn.microsoft.com/azure/developer/terraform/overview
- GitHub Advanced Security: https://learn.microsoft.com/azure/devops/repos/security/configure-github-advanced-security-features
- Bicep linter: https://learn.microsoft.com/azure/azure-resource-manager/bicep/linter