Skip to content

Repository files navigation

IaC Security Patterns

A small library of Pulumi/GCP patterns for the parts of infrastructure-as-code where a subtle mistake is a security incident, not a broken build. Each pattern is written up as: the failure mode it prevents, a minimal generic code sample, and — where it applies — the test that stops the mistake from ever recurring.

Generic and illustrative. All identifiers are placeholders (platform-prod, example.com, deploy-sa@…). These are patterns to adapt, not a deployable product.

The patterns

Pattern Prevents
authoritative-iam Authoritative IAM bindings silently clobbering each other's members — the "why did that role lose its members overnight?" outage. Includes an AST regression test that fails CI if a second authoritative binding for a role ever appears.
keyless-ci-wif Long-lived service-account JSON keys in CI. Replaces them with Workload Identity Federation, with trust pinned to immutable repository claims so a repo rename or transfer can't hijack the deploy identity.
adopting-clickops-into-iac Losing control of resources created by hand in the console. Adopts them into Pulumi with minimal blast radius — enforce one or two invariants, leave everything else owned by the operator lifecycle.
binary-authorization Unverified container images reaching production. Stands up a Binary Authorization policy in dry-run first, with a documented path to enforcement and a risk-acceptance memo.

Why these four

They're the patterns where I've seen the gap between "the deploy succeeded" and "the estate is actually safe" bite hardest:

  • IAM authority is the one most people get wrong, because the failure is silent and delayed — the members vanish on the next unrelated deploy, not the one that caused it.
  • CI credentials are the highest-value secret you own; a leaked deploy key is game over, so the goal is to not have one at all.
  • Click-ops drift is inevitable in any real org; the skill is adopting it safely rather than either ignoring it or rebuilding it and causing an outage.
  • Supply chain (what image is even allowed to run) is the control most estates skip, and dry-run-first is how you add it without breaking every deploy on day one.

A note on the code

Every sample is trimmed to the pattern. Real stacks have more wiring (config plumbing, outputs, tests around the edges); that's deliberately elided so the pattern itself is legible. The companion architecture that ties these together lives in gcp-pulumi-reference-architecture.

About

Pulumi/GCP security patterns: authoritative IAM (+AST tests), keyless CI via Workload Identity Federation, click-ops to IaC adoption, binary authorization.

Topics

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages