Compromising Pipelines with Evil Terraform Providers

The speaker demonstrates how attackers can compromise CI/CD pipelines by injecting malicious Terraform providers or abusing data sources to exfiltrate credentials and state files during the plan phase, bypassing traditional security controls.

Key Takeaways:
• The speaker introduces the context of increasing supply chain attacks in NPM and GitHub Actions to highlight the need for similar scrutiny in Infrastructure as Code. 0:45
• Attackers can exploit Terraform's provider ecosystem by publishing malicious providers that execute during terraform plan to steal credentials, environment variables, and state files. 12:15
• Defense strategies include enforcing network egress controls, using policy-as-code tools like Conftest, restricting provider usage via allowlists, and implementing OIDC-based identity controls for pipelines. 18:30

Understanding these attack vectors emphasizes the critical need to treat Terraform providers as trusted code and implement strict supply chain security measures to prevent pipeline compromise.

Sources:

• 0:02 Introduction and speaker background
• 0:45 Context on supply chain security trends in NPM and GitHub Actions
• 12:15 Demonstration of malicious provider exploitation during plan
• 18:30 Defensive strategies including egress controls and policy-as-code