c3.2 Use infrastructure as code
Describe infrastructure as code with CloudFormation, the AWS CDK, or Terraform. IaC brings versioning and change management, lets you scan templates for issues before deploy, and makes rebuilding a compromised environment fast and repeatable.
Implementation guidance
Build infrastructure from versioned code
Define your infrastructure with AWS CloudFormation, the AWS CDK, or third-party tools such as HashiCorp Terraform. Infrastructure as code (IaC) improves governance, versions your architecture, feeds it into change management, and lets you rebuild a compromised environment quickly and consistently.
Adopting IaC early pays off, but retrofitting templates onto existing infrastructure is not trivial. If your organization will eventually move to IaC, prioritize starting sooner.
Scan templates before you deploy
Catch misconfigurations before they exist by validating templates in the pipeline:
- AWS CloudFormation Guard checks templates against policy-as-code rules — for example, requiring encryption on every bucket.
- Tools like cfn-nag, checkov, and cdk-nag (bundled in the Automated Security Helper) scan IaC for insecure patterns.
Validate before you deploy
Gate the pipeline on a policy check — for example, fail the build if a template violates your CloudFormation Guard rules:
cfn-guard validate \
--data template.yaml \
--rules security-rules.guardHow to validate
- Is your infrastructure defined as code and kept under version control?
- Do you scan IaC templates for security issues before deploy (for example CloudFormation Guard, checkov)?
- Could you rebuild a compromised environment from code quickly?
Threats addressed
- Manually built infrastructure drifts, is hard to audit, and is slow to rebuild after a compromise; unreviewed changes can silently introduce insecure configurations.
AWS services
AWS CloudFormation Pricing
AWS CloudFormation itself is free — you pay only for the resources it provisions. See CloudFormation pricing.