Securing deployments

The last threat we must address is the potential compromise of our deployed services or the systems in our software development pipeline. We often focus heavily on securing the production systems where we deploy our software, but we need to treat the systems that build our software as if they are production systems too.

Infrastructure as code

IaC is a practice in which infrastructure configuration is managed and provisioned through machine-readable definition files, rather than physical hardware configuration or interactive configuration tools. In short, it consists of declarative files that describe what the desired infrastructure (servers, networks, VMs, services, etc.) should look like, and automatically creates it. This provides considerable benefits in terms of consistency, scalability, and flexibility to accommodate ad hoc needs. It also means that code misconfigurations can quickly propagate and put the whole infrastructure at risk: for example, forgetting...