Infrastructure Security

INFRASTRUCTURE AS CODE SECURITY

Catch misconfigurations before they reach production. SOVA scans your Terraform, CloudFormation, Kubernetes, Dockerfile, Ansible, and Helm templates for security issues and maps findings to CIS, PCI-DSS, SOC 2, HIPAA, and NIST compliance frameworks.

The Problem

YOUR INFRASTRUCTURE CODE HAS MORE MISCONFIGURATIONS THAN YOUR APP CODE

One misconfigured S3 bucket. One overly permissive security group. One hardcoded secret in Terraform. Infrastructure-as-Code shifts deployment left — but also shifts risk left.

67%

Of IaC templates have misconfigurations

Palo Alto research found that 67% of IaC templates have at least one security misconfiguration. Your infrastructure is only as secure as the code that defines it.

49%

Of data breaches from misconfiguration

Nearly half of all cloud data breaches are caused by misconfigurations, not sophisticated attacks. The door was left open.

$5.3M

Average cloud breach cost

Cloud security breaches cost 13% more than the average breach (IBM). Most are preventable with proper IaC scanning.

Real-World Incident Analysis

critical

Capital One S3 Breach

2019

100M+records exposed

Attack Timeline

Mar 2019

discovery

WAF misconfiguration found

Attacker discovers SSRF vulnerability in WAF

Mar-Jul 2019

exploit

Data exfiltration

Attacker accesses S3 buckets via SSRF exploit

Jul 17, 2019

disclosure

Breach reported

Tipster reports findings on GitHub

Jul 19, 2019

impact

FBI arrests attacker

Paige Thompson arrested for unauthorized access

Aug 2019

patch

Public disclosure

Capital One discloses 100M+ records exposed

Mar 2019

WAF misconfiguration found

Attacker discovers SSRF vulnerability in WAF

Mar-Jul 2019

Data exfiltration

Attacker accesses S3 buckets via SSRF exploit

Jul 17, 2019

Breach reported

Tipster reports findings on GitHub

Jul 19, 2019

FBI arrests attacker

Paige Thompson arrested for unauthorized access

Aug 2019

Public disclosure

Capital One discloses 100M+ records exposed

Attack Flow

Attacker

SSRF via misconfigured WAF

EC2 Metadata

169.254.169.254 returns IAM credentials

IAM Role

Stolen credentials have S3 read access

S3 Buckets

100M+ customer records exfiltrated

Attacker

SSRF via misconfigured WAF

EC2 Metadata

169.254.169.254 returns IAM credentials

IAM Role

Stolen credentials have S3 read access

S3 Buckets

100M+ customer records exfiltrated

Vulnerable Code

main.tfHCL

1# MISCONFIGURED (no encryption, public access)
2resource "aws_s3_bucket" "customer_data" {
3  bucket = "capitalone-customer-data"
4  acl    = "public-read"  # VULNERABLE!
5
6  # MISSING: Server-side encryption
7  # MISSING: Bucket policy
8  # MISSING: VPC endpoint restriction
9}
10
11# SECURE Configuration
12resource "aws_s3_bucket" "customer_data_secure" {
13  bucket = "capitalone-customer-data"
14
15  server_side_encryption_configuration {
16    rule {
17      apply_server_side_encryption_by_default {
18        sse_algorithm = "aws:kms"
19      }
20    }
21  }
22}

What Happened

The S3 bucket was publicly accessible with no encryption. A WAF misconfiguration allowed SSRF to the EC2 metadata endpoint, which returned IAM credentials with S3 access.

How SOVA Prevents This

Infrastructure Misconfiguration Detection

SOVA catches IaC security issues before deployment.

IaC Scanning

IaCEngine scans Terraform files, detects acl = 'public-read' on S3

Rule Matching

Rule engine flags: CIS AWS 2.1.1 (S3 not publicly accessible)

Critical Finding

CRITICAL — Missing encryption + missing public access block

Auto-Remediation

Generates secure configuration with KMS encryption and public access block

IaC Scanning

IaCEngine scans Terraform files, detects acl = 'public-read' on S3

Rule Matching

Rule engine flags: CIS AWS 2.1.1 (S3 not publicly accessible)

Critical Finding

CRITICAL — Missing encryption + missing public access block

Auto-Remediation

Generates secure configuration with KMS encryption and public access block

How It Works

IaC Security Scan Pipeline

IaC Files

TerraformK8sDockerfileCloudFormationAnsible

IaCEngine: Parse & Analyze

main.tf:14 — S3 bucket without encryption

Dockerfile:3 — Running as root

Rule Engine: 200+ Rules

CIS BenchmarkPCI-DSSSOC 2

Findings Dashboard

Critical: 2

High: 5

Medium: 12

Low: 8

Remediation

Fix Suggestions + PR Comments

Supported Formats

WHAT WE SCAN

.tf, .tfvars

Terraform

resource "aws_s3_bucket" "data" {
  bucket = "company-data-lake"
  acl    = "public-read"
}

SEC-001 · CRITICAL

S3 bucket publicly accessible

.yaml, .json

CloudFormation

MyRDSInstance:
  Type: AWS::RDS::DBInstance
  Properties:
    Engine: mysql
    PubliclyAccessible: true
    StorageEncrypted: false

SEC-008 · CRITICAL

Database exposed to internet

.yaml, .yml

Kubernetes

containers:
  - name: app
    image: myapp:latest
    securityContext:
      privileged: true
      runAsUser: 0

K8S-003 · HIGH

Container running as privileged

Dockerfile

FROM ubuntu:latest
RUN apt-get update && apt-get install -y curl
COPY . /app
USER root
CMD ["python", "app.py"]

DOC-002 · HIGH

Container running as root

.yml, .yaml

Ansible

- hosts: webservers
  become: yes
  vars:
    db_password: "SuperSecret123!"
  tasks:
    - name: Configure database
      shell: "mysql -p{{ db_password }}"

ANS-001 · CRITICAL

Credentials in playbook

values.yaml

Helm Charts

service:
  type: LoadBalancer
  port: 8080
networkPolicy:
  enabled: false
ingress:
  tls: []

HELM-005 · MEDIUM

Service exposed without restrictions

Findings Dashboard

SCAN RESULTS

Real-time findings from SOVA's IaC analysis engine. Every misconfiguration is mapped to a severity level, file location, rule ID, and description with remediation guidance.

SeverityFileLineRuleDescription

CRITICALinfra/main.tf47SEC-001S3 bucket allows public read access

HIGHk8s/deployment.yaml23K8S-003Container running as privileged

HIGHDockerfile1DOC-002Using latest tag for base image

MEDIUMinfra/rds.tf89SEC-012RDS encryption at rest not enabled

MEDIUMk8s/service.yaml15K8S-007Service exposed without network policy

LOWinfra/variables.tf12TF-001Variable missing description

1Critical

2High

2Medium

1Low

Compliance Mapping

BENCHMARK ALIGNMENT

200+ controls

CIS Benchmarks

AWS / Azure / GCP

Industry-standard security configuration benchmarks. SOVA maps each IaC finding to specific CIS controls with remediation guidance. Covers compute, storage, networking, IAM, logging, and monitoring controls.

CIS AWS 2.1.1 — Ensure S3 bucket policy prohibits public access
CIS AWS 3.1 — Ensure CloudTrail is enabled in all regions
CIS Azure 4.3.1 — Ensure Storage Account has encryption enabled

78 requirements

PCI-DSS 4.0.1

Requirement 2 — No default passwords

Payment card data security requirements. Validates that infrastructure configurations do not use default credentials, enforce strong authentication, and segment cardholder data environments.

Req 2.2.1 — Change vendor-supplied defaults before deployment
Req 1.3.1 — Restrict inbound traffic to cardholder data environment
Req 3.4 — Render PAN unreadable anywhere it is stored

64 criteria

SOC 2

CC6.1 — Access Controls

Trust Services Criteria for security, availability, and confidentiality. Maps IaC configurations to logical access controls, system boundaries, encryption requirements, and change management processes.

CC6.1 — Logical access security over protected information assets
CC6.3 — Role-based access and least privilege enforcement
CC7.2 — System activity monitoring and anomaly detection

45 safeguards

HIPAA

Section 164.312 — Encryption

Technical safeguards for electronic protected health information (ePHI). Validates encryption at rest and in transit, access controls, audit logging, and integrity verification for infrastructure handling PHI.

§164.312(a)(1) — Access control to ePHI systems
§164.312(e)(1) — Encryption of ePHI in transit
§164.312(b) — Audit controls for information system activity

325 controls

NIST SP 800-53

Configuration Management

Security and privacy controls for federal information systems. Comprehensive mapping for access control (AC), audit and accountability (AU), configuration management (CM), and system and communications protection (SC).

CM-6 — Configuration settings aligned with hardening guides
AC-3 — Access enforcement based on security policies
SC-28 — Protection of information at rest via encryption

Custom Rules

YOUR POLICIES, YOUR RULES

Define custom security rules using a declarative YAML format. Specify resource types, attribute conditions, severity levels, framework mappings, and remediation guidance. SOVA evaluates every IaC resource against your custom rule set at scan time.

Rule Definition Format

.sova-rules/no-public-s3.yaml

rule: no-public-s3
severity: critical
resource: aws_s3_bucket
condition: acl != "public-read" AND acl != "public-read-write"
message: "S3 buckets must not be publicly accessible"
frameworks: [CIS-AWS-2.1.5, PCI-DSS-1.3.1]
remediation: |
  Remove the 'acl' argument or set it to 'private'.
  Enable S3 Block Public Access at the account level.
tags: [storage, public-access, data-exposure]

Field Reference

ruleUnique identifier for the rule. Used in findings and policy references.
severityOne of: critical, high, medium, low. Determines pipeline gate behavior.
resourceThe IaC resource type to target (e.g., aws_s3_bucket, aws_rds_cluster).
conditionBoolean expression evaluated against resource attributes. Supports AND, OR, NOT, and nested field access.
messageHuman-readable finding description shown to developers in scan results.
frameworksCompliance framework controls this rule maps to. Enables framework-based reporting.
remediationMulti-line fix guidance. Can include links to internal wikis or approved patterns.
tagsCategorization tags for filtering and grouping rules in dashboards.

SECURE YOUR INFRASTRUCTURE BEFORE DEPLOYMENT

Catch misconfigurations in Terraform, Kubernetes, and Dockerfiles before they reach production.

Scan Your IaC View CI/CD Integration

Loading SOVA...

YOUR INFRASTRUCTURE CODE HAS MORE MISCONFIGURATIONS THAN YOUR APP CODE

One misconfigured S3 bucket. One overly permissive security group. One hardcoded secret in Terraform. Infrastructure-as-Code shifts deployment left — but also shifts risk left.

67%

Of IaC templates have misconfigurations

Palo Alto research found that 67% of IaC templates have at least one security misconfiguration. Your infrastructure is only as secure as the code that defines it.

49%

Of data breaches from misconfiguration

Nearly half of all cloud data breaches are caused by misconfigurations, not sophisticated attacks. The door was left open.

$5.3M

Average cloud breach cost

Cloud security breaches cost 13% more than the average breach (IBM). Most are preventable with proper IaC scanning.

1# MISCONFIGURED (no encryption, public access)

2resource "aws_s3_bucket" "customer_data" {

3 bucket = "capitalone-customer-data"

4 acl = "public-read" # VULNERABLE!

6 # MISSING: Server-side encryption

7 # MISSING: Bucket policy

8 # MISSING: VPC endpoint restriction

9}

11# SECURE Configuration

12resource "aws_s3_bucket" "customer_data_secure" {

13 bucket = "capitalone-customer-data"

15 server_side_encryption_configuration {

16 rule {

17 apply_server_side_encryption_by_default {

18 sse_algorithm = "aws:kms"

19 }

20 }

21 }

22}

WHAT WE SCAN

.tf, .tfvars

Terraform

resource "aws_s3_bucket" "data" {
  bucket = "company-data-lake"
  acl    = "public-read"
}

SEC-001 · CRITICAL

S3 bucket publicly accessible

.yaml, .json

CloudFormation

MyRDSInstance:
  Type: AWS::RDS::DBInstance
  Properties:
    Engine: mysql
    PubliclyAccessible: true
    StorageEncrypted: false

SEC-008 · CRITICAL

Database exposed to internet

.yaml, .yml

Kubernetes

containers:
  - name: app
    image: myapp:latest
    securityContext:
      privileged: true
      runAsUser: 0

K8S-003 · HIGH

Container running as privileged

Dockerfile

FROM ubuntu:latest
RUN apt-get update && apt-get install -y curl
COPY . /app
USER root
CMD ["python", "app.py"]

DOC-002 · HIGH

Container running as root

.yml, .yaml

Ansible

- hosts: webservers
  become: yes
  vars:
    db_password: "SuperSecret123!"
  tasks:
    - name: Configure database
      shell: "mysql -p{{ db_password }}"

ANS-001 · CRITICAL

Credentials in playbook

values.yaml

Helm Charts

service:
  type: LoadBalancer
  port: 8080
networkPolicy:
  enabled: false
ingress:
  tls: []

HELM-005 · MEDIUM

Service exposed without restrictions

SCAN RESULTS

Real-time findings from SOVA's IaC analysis engine. Every misconfiguration is mapped to a severity level, file location, rule ID, and description with remediation guidance.

SeverityFileLineRuleDescription

CRITICALinfra/main.tf47SEC-001S3 bucket allows public read access

HIGHk8s/deployment.yaml23K8S-003Container running as privileged

HIGHDockerfile1DOC-002Using latest tag for base image

MEDIUMinfra/rds.tf89SEC-012RDS encryption at rest not enabled

MEDIUMk8s/service.yaml15K8S-007Service exposed without network policy

LOWinfra/variables.tf12TF-001Variable missing description

1Critical

2High

2Medium

1Low

BENCHMARK ALIGNMENT

200+ controls

CIS Benchmarks

AWS / Azure / GCP

CIS AWS 2.1.1 — Ensure S3 bucket policy prohibits public access
CIS AWS 3.1 — Ensure CloudTrail is enabled in all regions
CIS Azure 4.3.1 — Ensure Storage Account has encryption enabled

78 requirements

PCI-DSS 4.0.1

Requirement 2 — No default passwords

Payment card data security requirements. Validates that infrastructure configurations do not use default credentials, enforce strong authentication, and segment cardholder data environments.

Req 2.2.1 — Change vendor-supplied defaults before deployment
Req 1.3.1 — Restrict inbound traffic to cardholder data environment
Req 3.4 — Render PAN unreadable anywhere it is stored

64 criteria

SOC 2

CC6.1 — Access Controls

CC6.1 — Logical access security over protected information assets
CC6.3 — Role-based access and least privilege enforcement
CC7.2 — System activity monitoring and anomaly detection

45 safeguards

HIPAA

Section 164.312 — Encryption

§164.312(a)(1) — Access control to ePHI systems
§164.312(e)(1) — Encryption of ePHI in transit
§164.312(b) — Audit controls for information system activity

325 controls

NIST SP 800-53

Configuration Management

CM-6 — Configuration settings aligned with hardening guides
AC-3 — Access enforcement based on security policies
SC-28 — Protection of information at rest via encryption

YOUR POLICIES, YOUR RULES

Rule Definition Format

.sova-rules/no-public-s3.yaml

rule: no-public-s3
severity: critical
resource: aws_s3_bucket
condition: acl != "public-read" AND acl != "public-read-write"
message: "S3 buckets must not be publicly accessible"
frameworks: [CIS-AWS-2.1.5, PCI-DSS-1.3.1]
remediation: |
  Remove the 'acl' argument or set it to 'private'.
  Enable S3 Block Public Access at the account level.
tags: [storage, public-access, data-exposure]

Field Reference

ruleUnique identifier for the rule. Used in findings and policy references.
severityOne of: critical, high, medium, low. Determines pipeline gate behavior.
resourceThe IaC resource type to target (e.g., aws_s3_bucket, aws_rds_cluster).
conditionBoolean expression evaluated against resource attributes. Supports AND, OR, NOT, and nested field access.
messageHuman-readable finding description shown to developers in scan results.
frameworksCompliance framework controls this rule maps to. Enables framework-based reporting.
remediationMulti-line fix guidance. Can include links to internal wikis or approved patterns.
tagsCategorization tags for filtering and grouping rules in dashboards.