# Infrastructure as Code Security Issues

> Detects security misconfigurations in Terraform, Pulumi, and CloudFormation templates including overly permissive resources and disabled security features.

- Skill: `zakirkun/infrastructure-as-code-security-issues` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/infrastructure-as-code-security-issues`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/infrastructure-as-code-security-issues/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/infrastructure-as-code-security-issues

---


# Infrastructure as Code Security Issues

## Overview
Infrastructure as Code (IaC) templates define cloud resources and their security posture. Misconfigurations in Terraform/CloudFormation/Pulumi templates propagate to all deployed environments.

Common IaC security issues:
- Encryption disabled on storage/databases
- Public-facing databases without VPC restriction
- Logging and monitoring disabled
- Overly permissive IAM and security groups
- SSH access open to all IPs

## Remediation
Use security linting tools (tfsec, checkov, cfn-nag, KICS) in CI/CD pipelines to catch IaC misconfigurations before deployment.