IaC Security

When to use

This skill reviews Infrastructure-as-Code for misconfig: over-broad IAM, public storage, missing encryption, open security groups, logging off. It leans on the cloud-provider best practices plus CIS benchmarks and orchestrates the common scanners.

Activates on:

• A request like "scan this Terraform for misconfigs", "checkov on our CloudFormation template", "is this S3 bucket policy OK", "review our Pulumi stack", "write a Conftest policy".
• New or modified IaC files: *.tf, *.tfvars, *.hcl, CloudFormation *.yaml/*.json templates, Ansible playbook.yml, roles/, Pulumi Pulumi.yaml plus __main__.py/index.ts.
• A compliance audit (ISO/SOC2/NIS2) that asks for cloud-control evidence.
• A handoff from security-review phase 3 where IaC sits in the diff.
• A drift suspicion: "is prod drifting from the Terraform state?".

When NOT to use (handoff)