listen to this article:


In today’s age of Cloud and mobile first, creating and maintaining infrastructure manually across hyper scalers and on-premises is no longer sustainable. The ever-increasing business demand to release more frequently further complicates this, with application and infrastructure changes coming in at break-neck speed. Stability, scaling and security of infrastructure is paramount for any application.

Modern DevOps and Cloud Engineering teams are resolving this quandary by programmatically defining infrastructure “resources” (VM’s, network, configurations etc.) as code. The practice is aptly called Infrastructure-as-Code.

What is Infrastructure-as-Code?

Infrastructure-as-code (IaC) is the management of infrastructure (networks, computers, virtual machines, load balancers, and connection topology) in a descriptive model, as code. Just as a code generates the same binary every time, an IaC model generates the same environment every time it is applied.

Common IaC tools include Chef, Puppet, Ansible, Terraform, and Pulumi.

How Infrastructure-as-Code Works: The Pets-vs-Cattle Service Model

A common illustration used to describe IaC is the notion of “pets vs cattle” for the infrastructure service model. This was first introduced by Bill Baker on topic of scaling up vs scaling out at Scaling SQL Server 2012 and was later popularized by Gavin McCance in CERN Data Centre Evolution presentation.

In the pets service model, each pet server is given a loving name like Zeus, Hades, Poseidon, etc. They are “unique, lovingly hand-raised, and cared for, and when they get sick, you nurse them back to health”. You scale these up by making them bigger, and when they are unavailable, everyone notices.

In the cattle service model, the servers are given identification numbers like web01, web02, db01, db02 etc., much the same way cattle are given numbers. Each server is “almost identical to each other” and “when one gets sick, you replace it with another one”. You scale these by creating more of them, and when one is unavailable, no one notices.

IaC tools are used to create, maintain, or decommission such infrastructure at scale. For example, the below snippet of terraform code (an IaC tool) uses AWS, in the region of “us-west-2” to create an AWS instance, with specified AMI and size t2.micro:

provider “aws” {
          profile                   = “default”
          region                   = “us-west-2”

resource “aws_instance” “web01” {
          ami                       = “ami-830c94e3”
          instance_type    = “t2.micro”

Developers can now setup all the parameters required to create the infrastructure-as-code. When this is parameterized and extended, it is easy to imagine spinning up a thousand servers across 5 regions very quickly.

Why are Organizations Moving Towards IaC?

When you start treating your infrastructure as code, there are several inherent advantages:

  1. Apply DevOps principles to infratructure: Just like application code, IaC enables infrastructure to be managed through code. This enables us to apply DevOps principles like single source of truth, code reviews, security scans, unit, and integration testing, etc.
  2. Speed and repeatability: Ability to launch, manage and destroy infrastructure and configuration at scale, at a very rapid speed. Since the infrastructure is being created by the same code, there is absolute repeatability. On the flip side, if there’s an error in the code, that too gets replicated across. That’s where the DevOps principles, like code reviews for example, come to the rescue.
  3. Security and auditability: IaC code can be reviewed by Security teams and evaluated by testing tools. Since the code is in source control, there is auditability on who changed what and when.
  4. IaC as part of CDLC: IaC is considered as part of the Cloud Development Lifecycle (CDLC), which is composed of three phases:
    • Development: Creation of IaC templates;
    • Deployment: Provision of infrastructure by executing IaC templates;
    • Runtime: Update the IaC to changes at runtime.

This new paradigm encourages and extends the use of proven SDLC (Software Development Lifecycle) principles to CDLC (Cloud Development Lifecycle).

How Can Developers Enhance the Security Posture of Cryptography in Infrastructure-as-Code?

The 2021 IaC Security Insights report states that 45% of respondents find out about security issue in configurations and IaC after deployment.

2021 IaC Security Insights Report

Here are key considerations for developers to enhance the security posture of cryptography in IaC templates:

Where to hold cryptographic keys and digital certificates? Traditionally, developers have stored certificates and secrets locally in the build servers or at a shared location, for ease of use with CI systems. However, this is risky and invites malicious activity.

How to manage cryptography? Modern rapid development and release requires on-demand access to cryptographic keys. The traditional usage of and other mechanisms may not be the most convenient from a developer’s perspective.

What about integration with CI/CD? A developer would appreciate flexibility while integrating with CI/CD pipelines:

  • Local sign: integrate with OS/Platform signer utilities (like JDK’s jarsigner/keytool or Microsoft SDK’s signtool.exe) and security provider (HSM or vendor);
  • Remote sign: REST api’s to send file to vendor, who will sign and return.

All these considerations ought to be addressed by modern cryptographic solutions, which are built to operate across legacy and cloud native worlds. The solution should offer a FIPS-certified key management system, which can be orchestrated as part of the IaC. It should also have the ability to access cryptographic keys on-demand.

Learn how Unbound CORE secures the code signing process throughout the software development lifecycle

Secure IaC Is The Future

With cloud native technologies like Kubernetes and serverless achieving mainstream adoption, IaC is gaining traction and becoming critical for the success of an enterprise. It also enables developers to manage their infrastructure and configuration more effectively.

The advanced cryptographic code signing techniques complete the security loop of IaC. By offering code signing solutions across the technology stacks, from traditional Java, DotNet to Mobile code and container/serverless, they have enabled software delivery at scale.