Fantastic Infrastructure as Code security attacks and how to find them

What this post added

This post introduces and details specific security risks in Infrastructure as Code (IaC) management tools, particularly Terraform. It provides a practical example of an S3 bucket vulnerability and demonstrates how to detect it using multiple IaC security scanning tools (tfsec, kics, checkov, terrascan, semgrep, tflint). The post also covers parsing scan reports with `jq` and integrating these scanners into CI/CD pipelines and merge requests. It further suggests using resources like Terragoat for developing and testing IaC security scenarios.