Skip to content

Infrastructure code that ships its own keys

Duration
4m 12s
Steps
7
Agents
Recon, Triage, Fix

Sample runs against public, intentionally vulnerable apps. The vulnerabilities are real; timings and traces are illustrative.

Prompt
Review the AWS Terraform before it’s applied. Rank by what an attacker could actually reach.
  1. 00:03Recon

    Parsed the Terraform plan

    $ enforster iac ./terragoat/terraform/aws
    › Output
    96 resources · 74 raw policy violations
  2. 00:51TriageVerified

    Verified: AWS keys in EC2 user_data

    Access keys are written in plain text into the instance’s user_data script, readable from the instance metadata.

  3. 01:44TriageVerified

    Verified: unencrypted EBS volume

    encrypted = false on an attached data volume.

  4. 02:30TriageVerified

    Verified: S3 bucket without a public access block

    Bucket allows public ACLs and has no access logging.

  5. 03:10TriageDismissed

    Dismissed 61 violations

    Tagging rules, unused modules and resources not reachable from the internet.

  6. 03:56Fix

    Opened a PR with the fixes

    - encrypted = false+ encrypted = true+ resource "aws_s3_bucket_public_access_block" "data" { … }
  7. 04:12Triage

    Run complete: 3 verified, 61 dismissed

What it proved

  • Critical

    Cloud credentials embedded in EC2 user_data

    terraform/aws/ec2.tf

    Proof
    Keys readable via instance metadata
    Fix
    Use an instance profile; rotate the keys
  • Medium

    EBS data volume not encrypted

    terraform/aws/ec2.tf

    Proof
    encrypted = false
    Fix
    Set encrypted = true with a KMS key
  • Medium

    S3 bucket allows public ACLs

    terraform/aws/s3.tf

    Proof
    No public access block
    Fix
    Add aws_s3_bucket_public_access_block
Next runFrom login form to admin in one request

A 30-minute demo with zero slides. Bring a repo, a domain or a cloud account and we’ll show you what’s actually exploitable, live.

Book a demo