Stop 28 of 42 · The Building · Infrastructure-as-code mistakes

A blueprint that builds the same mistake everywhere

The bank’s cloud is built from a blueprint (Terraform). If the blueprint says “storage room door: open to the public,” every new branch built from it gets an open door, quickly and perfectly, every time.

Severity Low–CriticalCategory Infrastructure MisconfigurationThe BuildingSources checked 25 Oct 2026

Watch it happen

Play it as

A blueprint marks the storage room as public. The crew copies it into every new branch, and Mallory simply walks in and reads the files.

Arrival

Mallory strolls up to the bank’s front door. She isn’t carrying any tools.

Mallory says: Just browsing.

1 / 4

In bank terms and app terms

In the bank	In your app
Construction blueprint	Terraform / CloudFormation files
Open storage room door	S3 bucket made public (public ACL or policy, public access block turned off), or a firewall open to 0.0.0.0/0
Copying the blueprint to new branches	Reusing the same module for staging, production and new regions
Master key on the blueprint	Secrets hardcoded in variable defaults or .tfvars

Are you exposed?

You might be exposed if…

Your Terraform has acl = "public-read", turns off a bucket’s public access block, or opens a security group to 0.0.0.0/0 on non-web ports.
IAM policies use "*" for actions or resources, or secrets sit in variable defaults.
An AI tool generated your infrastructure files and nobody reviewed them line by line.

What to do about it

Keep buckets private and add a public access block; share files with signed, expiring links.
Open firewall ports only to the specific addresses or services that need them, and grant narrow IAM permissions.
Keep secrets out of the files (use a secrets manager), keep Terraform state in a private, encrypted backend (it can hold secrets in plain text), and review changes before applying.

Track these in your to-do list →

It has happened to real companies

Real-world breaches

Public cloud storage has exposed data from many companies. In 2017, Accenture left four AWS S3 buckets configured for public access, exposing credentials, keys and customer-related records (found by UpGuard). In 2021, Twitch said a server configuration change allowed improper access to its source code repository documents and a subset of creator payout data.

What it looks like in code

# GOOD: Private S3 bucket with encryption
resource "aws_s3_bucket" "data" {
  bucket = "my-app-data"
}

resource "aws_s3_bucket_public_access_block" "data" {
  bucket = aws_s3_bucket.data.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_s3_bucket_server_side_encryption_configuration" "data" {
  bucket = aws_s3_bucket.data.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "aws:kms"
    }
  }
}

Ask your AI tool to fix it

Paste this into Cursor, Claude, Lovable, Bolt or whatever you build with.

Prompt

Review all Terraform files. Make storage buckets private with a public access block and encryption, restrict security group ingress to specific CIDRs or security groups (only 80/443 may be public), replace wildcard IAM actions and resources with least-privilege ones, and move hardcoded secrets out to a secrets manager. List every resource you changed.

Where this comes from

The facts, figures and fixes on this page were checked against these sources on 25 Oct 2026. They are linked so you can check for yourself.

Blocking public access to your S3 storageAWSpublic access block overrides public ACLs and policies on buckets
Security group rules (VPC)AWS0.0.0.0/0 lets anyone reach instances; authorize specific ranges
Manage sensitive data in your configurationHashiCorpTerraform state is plaintext and includes secret values
Infrastructure as Code Security Cheat SheetOWASPkeep secrets out of IaC files and review changes
Accenture cloud leakUpGuardfour S3 buckets set to public access exposed credentials and keys (2017)
Twitch compromisedMalwarebytesTwitch said a server configuration change exposed data (2021)
Updates on the Twitch security incidentTwitchcause: a server configuration change; source code documents and a subset of payout data

Spot a mistake or something out of date? Report a correction · How these guides are made and checked

Go deeper in isitsecure

The free, open-source scanner checks for most of the problems in these guides.