Your Terraform Is Probably Insecure — Here Are 90 Patterns to Check

Cloud misconfigurations were responsible for 15% of all initial attack vectors in data breaches last year. Not zero-days. Not sophisticated exploits. Misconfigurations. Public S3 buckets, overprivileged IAM roles, security groups that allow the entire internet to SSH in. The infrastructure-as-code revolution was supposed to fix this — codify your infrastructure, review it like application code, catch mistakes in PRs. But terraform plan tells you what will change. It does not tell you if what you're deploying is secure. I built CloudGuard to close that gap. 90 security patterns for Terraform and CloudFormation files. Here's what it checks and why. 1. Public S3 Buckets and Storage Access # The pattern — public-read ACL with no block resource "aws_s3_bucket" "assets" { bucket = "company-assets" acl = "public-read" # Anyone on the internet can read this } # The fix — block public access explicitly resource "aws_s3_bucket" "assets" { bucket = "company-assets" } resource "aws_s3_bucket_publi