Make the insecure configuration impossible to deploy

applied · 80 min · Objective 3.1

Task

Write infrastructure as code that deploys something insecure, then add the automated policy check that refuses it — a guard rail. Moving from 'we detect it afterwards' to 'it cannot be created' is the single most valuable pattern in this objective.

Steps

  1. Write /tmp/infra/storage.yaml: a small declarative description of a storage bucket with public: true, encryption: none and logging: false. This is the configuration you are going to make undeployable.
  2. Write a second file /tmp/infra/storage-good.yaml with the same resource configured correctly.
  3. Write /tmp/policy.py: it reads every YAML file in the directory and fails, naming the file and the rule, if any resource is public, unencrypted, or has logging disabled.
  4. Run it and confirm it rejects the first file and accepts the second. A policy that rejects both is not discriminating.
  5. Now wire it as a guard rail rather than a report: write /tmp/deploy.sh that runs the policy check FIRST and refuses to proceed to the deployment step on a non-zero exit.
  6. Prove the guard rail holds: run deploy.sh against the bad file and confirm the deployment step never executes, then against the good one and confirm it does.

Verify

python3 /tmp/policy.py /tmp/infra/storage-good.yaml; echo "good exit: $?"
python3 /tmp/policy.py /tmp/infra/storage.yaml; echo "bad exit: $?"
bash /tmp/deploy.sh /tmp/infra/storage.yaml 2>&1 | grep -ci "deploying"
bash /tmp/deploy.sh /tmp/infra/storage-good.yaml 2>&1 | grep -ci "deploying"

The good file must exit 0 and the bad file non-zero. The third must be 0 — the word deploying never appears, because the guard rail stopped before that step. The fourth must be non-zero. A guard rail that logs a warning and proceeds is a report, and the distinction is the entire point of the lab.

Notes

Notice where the security review has moved: it is no longer a meeting, it is a check that runs on every change, and the misconfiguration is not detected and remediated — it never exists. That is what the lesson means by security moving left, and it is why IaC concentrates risk in the repository and the pipeline.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.