Notifications
Clear all
Topic starter
19/08/2026 3:53 pm
TL;DR: Infrastructure as code has moved from automation utility to enterprise control plane, where security, policy-as-code, drift detection, and secrets handling determine whether deployments stay auditable and resilient, according to Apiiro. The governance challenge is no longer choosing a tool, but proving that code-to-runtime controls can keep pace with multi-tool IaC sprawl.
NHIMG editorial — based on content published by Apiiro: the best infrastructure as code tools in 2025 and how to secure them
By the numbers:
- Only 44% of organisations are currently using a dedicated secrets management system.
Questions worth separating out
Q: How should security teams govern infrastructure as code for security platforms?
A: They should treat configuration files, APIs, and automation identities as privileged control paths.
Q: Why do over-privileged automation identities create risk in IaC pipelines?
A: Over-privileged automation identities can change infrastructure faster than human reviewers can detect.
Q: What breaks when drift detection is missing from infrastructure as code workflows?
A: Without drift detection, approved code no longer matches what is actually running, and unauthorised changes can persist unnoticed.
Practitioner guidance
- Implement policy-as-code gates in every IaC workflow Enforce security and compliance checks at pull request, plan, and apply stages so insecure changes fail before deployment.
- Restrict automation identities to just enough privilege Separate human approvals from machine execution and scope each pipeline identity to the smallest set of resources, environments, and actions it actually needs.
- Protect IaC state as sensitive control-plane data Store remote state in encrypted backends, lock access to approved operators and pipelines, and monitor for unauthorized state changes.
What's in the full article
Apiiro's full article covers the operational detail this post intentionally leaves for the source:
- Tool-by-tool feature comparisons across Terraform, OpenTofu, Pulumi, CloudFormation, Bicep, and orchestration layers
- The specific governance capabilities each platform exposes for policy enforcement, state handling, and enterprise workflow control
- Practical implementation details for integrating scanning, drift detection, and pipeline security into real DevSecOps environments
- The article's own evaluation criteria for security, usability, and ecosystem fit when choosing an IaC stack
👉 Read Apiiro's analysis of the best infrastructure as code tools in 2025 →
Infrastructure as code governance: are your controls keeping up?
Explore further
19/08/2026 4:30 pm
Infrastructure as code has become an identity governance problem, not just an automation problem. Once deployment logic is expressed as code, the trust boundary shifts to service accounts, tokens, and orchestration identities. That means access control, secret lifecycle management, and auditability now shape whether IaC is safe to operate at scale. The practical conclusion is that IaC governance and identity governance must be designed together, not treated as separate workstreams.
A question worth separating out:
Q: What should teams do when IaC secrets and state files are exposed?
A: Teams should treat exposed IaC secrets and state files as privileged incidents, not routine hygiene issues. Revoke and rotate credentials, inspect recent deployment activity, review access to the state backend, and validate whether any infrastructure was altered using the compromised path. The goal is containment before the control plane is reused.
👉 Read our full editorial: Infrastructure as code tools now define security, drift, and governance
