Notifications
Clear all
Topic starter
12/06/2026 12:04 am
TL;DR: IaC modernization is moving infrastructure changes into reusable modules, policy-as-code, secrets handling, and drift detection so teams can scale safely, according to ControlMonkey. The governance issue is that faster pipelines widen the blast radius of mis-scoped access unless identity controls keep pace with automated change.
NHIMG editorial — based on content published by ControlMonkey: IaC modernization sits at the core of scalable, secure, and resilient cloud operations
By the numbers:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
Questions worth separating out
Q: How should teams govern secrets in infrastructure as code pipelines?
A: Teams should keep secrets out of code and move them into a dedicated runtime secrets service, then enforce policy that prevents repository storage and console exposure.
Q: Why do reusable IaC modules change the IAM risk profile?
A: Reusable modules copy identity decisions across many accounts, so one privilege mistake can multiply quickly.
Q: What do security teams get wrong about policy-as-code in cloud deployments?
A: They often treat policy-as-code as a compliance layer instead of an identity boundary.
Practitioner guidance
- Separate credential storage from infrastructure code Move all cloud keys, tokens, and database credentials into a dedicated secrets manager or secret agent, and inject them only at runtime.
- Treat shared IaC modules as governed identity assets Apply ownership, code review, and version pinning to modules that contain IAM roles, network controls, or policy logic.
- Move access checks into pipeline enforcement Use policy-as-code to block non-compliant changes before apply, including overly permissive IAM roles, public exposure paths, and unapproved resource types.
What's in the full article
ControlMonkey's full blog post covers the operational detail this post intentionally leaves for the source:
- Concrete examples of module structure, folder standards, and versioning patterns for large IaC estates.
- Step-by-step pipeline controls for Terraform plan, policy checks, approval gates, and drift detection.
- Specific guidance on runtime secrets injection patterns, including temporary files and secrets agents.
- Leadership actions for rolling out shared modules, governance automation, and team operating models.
👉 Read ControlMonkey's guide to IaC modernization, policy checks, and secure pipelines →
IaC modernization and cloud identity controls: what teams miss?
Explore further
12/06/2026 9:05 am
IaC modernization is really an identity governance problem once cloud change is automated. The article frames the issue as tooling and process maturity, but the deeper shift is that deployment pipelines now decide who can change infrastructure, when they can do it, and with what privilege. That makes the pipeline a governance boundary, not just an engineering workflow. Practitioners should treat every IaC control as an access control.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: How do teams know if drift detection is actually working?
A: Drift detection is working when it consistently surfaces out-of-band console changes, manual privilege changes, and configuration edits before they become accepted state. If alerts only show cosmetic differences, the control is missing the identity and entitlement changes that matter most.
👉 Read our full editorial: IaC modernization is exposing cloud identity governance gaps
