Infrastructure as Remote Code Execution: How to abuse Terraform to elevate access
Mike McCabe
BSides NYC 2023 (0x04) · Day 1 · Talk - Red
This talk, presented by Mike McCabe, President of Cloud Security Partners, delves into the often-overlooked security implications of Infrastructure as Code (IaC) tools, specifically focusing on Terraform. While IaC is widely lauded for its ability to provision consistent, codified, and repeatable infrastructure, McCabe highlights how its inherent power and common misconfigurations can be abused to achieve remote code execution (RCE) and elevate access within cloud environments. The presentation is crucial for cloud architects, security professionals, and DevOps teams who rely on Terraform for deployments, offering a deep dive into the specific vulnerabilities and architectural pitfalls that attackers or malicious insiders can exploit.
AI review
Competent survey of Terraform attack surface — provisioner abuse, state file secrets, STS credential logging, and the 'after unknowns' policy bypass — delivered with working code examples and clear defensive pairing. Nothing here is new to anyone who's been paying attention to IaC security for the last two years, but it's organized, technically honest, and practically useful for the DevSecOps crowd that still hasn't internalized these risks.