07 - References, Standards and Tooling Index

To support continuous learning and production implementation of Infrastructure as Code (IaC) security, this chapter provides a curated index of industry standards, regulatory frameworks, open-source security tools, and official cloud provider documentation.

---

📚 Industry Standards & Security Frameworks

Center for Internet Security (CIS) Benchmarks

The CIS Benchmarks serve as the global consensus standard for hardening cloud environments and IaC configurations:

• CIS Amazon Web Services Foundations Benchmark v2.0.0
• CIS Microsoft Azure Foundations Benchmark v2.0.0
• CIS Google Cloud Computing Platform Benchmark v2.0.0
• CIS Kubernetes Benchmark

NIST SP 800-53 Rev. 5 Security Controls

Key controls mapped to Infrastructure as Code security implementation:

• CM-2 (Baseline Configuration): Maintaining documented, version-controlled IaC baselines.
• CM-6 (Configuration Settings): Mandatory automated scanning of IaC parameters prior to deployment.
• SA-11 (Developer Testing and Evaluation): Integrating SAST and Policy as Code into CI/CD pipelines.
• SC-28 (Protection of Information at Rest): Enforcing KMS key encryption for state storage and cloud data stores.

OWASP & US Government Guidance

• OWASP Infrastructure as Code Security Cheat Sheet
• OWASP Cloud Native Security Top 10
• NSA / CISA Cybersecurity Information Sheet: Mitigating Cloud Vulnerabilities

---

🛠️ Security Tools & Open-Source Projects

Static Application Security Testing (SAST)

• Checkov (Prisma Cloud)
  • Documentation: https://www.checkov.io/
  • Source Code: https://github.com/bridgecrewio/checkov
• tfsec (Aqua Security / Trivy)
  • Documentation: https://aquasecurity.github.io/tfsec/
  • Source Code: https://github.com/aquasecurity/tfsec
• Terrascan (Tenable)
  • Documentation: https://runterrascan.io/
  • Source Code: https://github.com/tenable/terrascan
• KICS (Checkmarx Keep Infrastructure as Code Secure)
  • Documentation: https://kics.io/
  • Source Code: https://github.com/Checkmarx/kics

Policy as Code Engines

• Open Policy Agent (OPA)
  • Documentation: https://www.openpolicyagent.org/docs/latest/
  • Rego Language Reference: https://www.openpolicyagent.org/docs/latest/policy-language/
  • Terraform Integration Guide: https://www.openpolicyagent.org/docs/latest/terraform/
• HashiCorp Sentinel
  • Documentation: https://docs.hashicorp.com/sentinel/

Drift Detection & Cloud Compliance

• driftctl (Snyk)
  • Source Code: https://github.com/snyk/driftctl
• Cloud Custodian
  • Documentation: https://cloudcustodian.io/
  • Source Code: https://github.com/cloud-custodian/cloud-custodian

---

📖 Official IaC Engine & Cloud Provider Documentation

HashiCorp Terraform

• Terraform Standard Module Structure & Security
• Terraform Backend S3 Configuration
• Terraform Cloud Workspaces & OIDC Identity Provider

AWS CloudFormation

• AWS CloudFormation Security Best Practices
• AWS Secrets Manager & SSM Dynamic References
• AWS CloudFormation Guard Rules Engine

Azure Bicep & ARM

• Azure Bicep Security Best Practices
• Bicep @secure Parameter Decorator
• Azure Key Vault Integration in Bicep

---

🔬 Academic & Technical Literature

• A Analysis of Infrastructure as Code Misconfigurations in Cloud Ecosystems (IEEE Transactions on Software Engineering, 2022)
• Automated Verification of Static Security Policies in Declarative Infrastructure Templates (ACM Symposium on Cloud Computing)
• Shifting Cloud Infrastructure Security Left: Empirical Evaluation of Static Analysis Tools on Production Terraform Code (Journal of Cybersecurity and Privacy)

---

[!NOTE] Continuous Learning: Security rules and cloud provider capabilities evolve rapidly. Regularly update local SAST scanners (Checkov, tfsec) and policy libraries to ensure protection against emerging cloud vulnerability vectors.