Infrastructure as code security with terraform and AWS attack surface discovery

Use of cloud technology is increasing day by day. Essential feature of cloud environments is that environments can be created and destroyed quickly. For this reason, an end-to-end security approach should be applied to cloud security. In this study, security controls that started before AWS environment were created continued after AWS environment was created. It is aimed at ensuring the end-to-end security of AWS environment. Terraform, which allows users to perform their transactions in the cloud environment quickly and easily, is also used by many users to manage the cloud environment. However, vulnerable cloud environments occur due to misconfigurations on Terraform files. In this study, Terraform files created by users are checked before the environment is up, and remediations are suggested to the users regarding vulnerabilities. In this context, firstly, Terraform files in the directory given by the users are examined. Then the security problems and improvement suggestions in the files are shown to the users. Security controls continue in AWS environment created after the improvements applied according to these mitigations. After that, the attack paths that attackers can follow are discovered by querying services in AWS environment. Showing these discovered attack paths to users. Thus, end-to-end security is provided that starts before environment is created and continues until the environment is closed. Finally, observed that vulnerabilities that may occur in AWS environment were detected, and vulnerabilities were fixed with mitigations given. End-to-end security is provided in this study with the metrics and evaluation criteria used in the tests.