Non-Codified Infrastructure

Expanded Definition

Non-codified infrastructure is cloud infrastructure that exists outside infrastructure as code workflows, meaning it was created, altered, or repaired manually rather than through reviewed source-controlled definitions. In Non-Human Identity security, that distinction matters because identity bindings, access policies, and recovery steps may exist only in the console or in an engineer’s memory.

Definitions vary across vendors, but the operational issue is consistent: if a resource is not represented in code, it is harder to test, attest, roll back, or prove ownership. That creates a visibility gap between what teams believe is deployed and what actually exists. It also weakens change control because manual edits can bypass review, policy checks, and peer approval.

Non-codified infrastructure is closely related to shadow change and configuration drift, but it is not identical. Drift can occur even when a resource began life in code, while non-codified infrastructure may never have entered source control at all. The most common misapplication is treating any production issue as an IaC failure, which occurs when teams ignore console-created resources and assume their deployment pipeline still represents the full system.

For broader governance context, the NIST Cybersecurity Framework 2.0 reinforces the need for asset visibility, protected configuration, and recovery planning even when implementation is distributed across teams.

Examples and Use Cases

Implementing controls against non-codified infrastructure rigorously often introduces some operational friction, requiring organisations to weigh rapid break-fix work against auditability, reproducibility, and safe recovery.

• A production firewall rule is added manually during an incident, then never backported into the Terraform repository, leaving later audits blind to the active exposure.
• A cloud database is provisioned directly in the console for a short-lived project, but its service account and secret rotation path are never documented in source control.
• A platform engineer adjusts IAM permissions outside the pipeline to restore service, creating a hidden privilege change that survives long after the ticket closes.
• An AI agent with infrastructure access makes an out-of-band change, and the team discovers the resource only after the next deployment fails to reconcile state.

These patterns are especially dangerous where recovery depends on assumptions that everything is codified. NHIMG’s Ultimate Guide to NHIs notes that only 5.7% of organisations have full visibility into their service accounts, which shows how easily manual infrastructure changes and identity dependencies can escape oversight. Standards bodies such as the NIST Cybersecurity Framework 2.0 treat visibility and recovery as core operational outcomes, not optional hygiene.

Why It Matters in NHI Security

Non-codified infrastructure becomes an NHI problem because unmanaged resources usually carry unmanaged identities: service accounts, API keys, tokens, certificates, and elevated permissions that are never fully inventoried. That creates failure modes that are hard to detect and even harder to remediate at scale. NHIMG research shows 96% of organisations store secrets outside secrets managers in vulnerable locations, and 80% of identity breaches involve compromised non-human identities such as service accounts and API keys.

When infrastructure exists outside code, the surrounding identity controls often weaken with it. Rotation schedules are missed, revocation paths are unclear, and least-privilege reviews cannot reliably cover what was created manually. This is why the issue is not just operational cleanliness but governance: it affects incident response, restoration confidence, and proof of control. The Ultimate Guide to NHIs also reports that 71% of NHIs are not rotated within recommended time frames, which compounds the risk when hidden infrastructure survives across changes.

Organisations typically encounter the recovery cost only after a failed restore, unexpected outage, or privilege review uncovers resources no one can explain, at which point non-codified infrastructure becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Why do non-human identities matter in critical infrastructure risk planning?
• Why do AI infrastructure and non-human identities need coordinated security testing?
• How should compliance and investigations teams respond when sanctioned crypto infrastructure is hit by an alleged theft and the stolen assets are rapidly swapped into non-freezable tokens?
• Why do non-human identities become harder to govern as infrastructure spans OAuth, cloud workloads, and AI services?