Compromising Terraform & AWS Atlantis Build Jobs
Source: YouTube · John Hammond · published Jul 26, 2023 · 24:16
The video demonstrates how attackers can exploit Terraform CI/CD pipelines to steal AWS admin credentials by abusing terraform plan operations that run with excessive permissions 1:02.
Key Takeaways:
• Even terraform plan operations (which should be read-only) often run with admin credentials, allowing attackers to steal AWS credentials through external providers 6:00.
• A simple pull request with malicious code can trigger a pipeline that leaks sensitive credentials to an attacker-controlled server 8:30.
• Common mitigation strategies include using separate roles with limited permissions for terraform plan vs apply operations and implementing approval processes 10:54.
Infrastructure as code requires careful security implementation - it provides great power but also great responsibility to protect against privilege escalation 23:04.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cloud Security. Commonly maps to: Security Architecture and Engineering, Communication and Network Security. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
but now we go back to my SSH here we have the AWS region access code a secret key and secret access key with all this information we can assume this role and we would be able to be a AWS admins without actually having that access alrighty how's it going everyone man it's so great to be hanging out with you uh Carlos polyp and Ignacio Dominguez my great friends again over at halborn and hey you two are the folks that are in the know with a whole lot of this cloud and devops security and uh if you don't mind I'd love to maybe learn a little bit about your whole perspective with terraform uh because terraform I know can be some incredible and awesome thing for infrastructure as code and at staging and preparing automating all of the things that you set up across the production environment but…