Skip to main content
← All controls
CM-2 / CM-3 / CM-9 NIST SP 800-53 Rev 5

Is cloud infrastructure managed via IaC (Terraform, CloudFormation, Bicep, Pulumi)?

Demonstrate that cloud infrastructure is provisioned and modified exclusively through version-controlled Infrastructure as Code tooling, with evidence of change management processes and minimal manual configuration drift.

Description

What this control does

Infrastructure as Code (IaC) management requires that cloud infrastructure provisioning, configuration, and lifecycle changes are defined in version-controlled declarative or imperative code using tools such as Terraform, AWS CloudFormation, Azure Bicep, or Pulumi. This approach replaces manual console-based changes with automated, repeatable deployments that undergo peer review, testing, and approval workflows. IaC enables configuration drift detection, audit trails of infrastructure changes, and the ability to restore or replicate environments consistently, reducing the attack surface introduced by ad-hoc modifications and undocumented shadow infrastructure.

Control objective

What auditing this proves

Demonstrate that cloud infrastructure is provisioned and modified exclusively through version-controlled Infrastructure as Code tooling, with evidence of change management processes and minimal manual configuration drift.

Associated risks

Risks this control addresses

  • Unauthorized or unapproved infrastructure changes bypass change control processes, introducing misconfigurations or backdoors without audit trails
  • Configuration drift between environments creates inconsistent security postures, allowing vulnerabilities in production that were not present in tested staging environments
  • Manual provisioning errors lead to overly permissive IAM policies, exposed storage buckets, or improperly configured network security groups
  • Lack of version control for infrastructure prevents rollback after security incidents or failed deployments, extending outage windows and attacker dwell time
  • Shadow IT infrastructure provisioned outside IaC tooling evades security scanning, compliance checks, and vulnerability management
  • Inability to reproduce disaster recovery environments accurately due to undocumented manual changes made directly in cloud consoles
  • Insufficient peer review of infrastructure changes allows insecure configurations to reach production without security team visibility

Testing procedure

How an auditor verifies this control

  1. Obtain a complete inventory of cloud accounts, subscriptions, or projects in scope across AWS, Azure, GCP, or other cloud providers.
  2. Review the organization's IaC repository structure and identify all active Terraform workspaces, CloudFormation stacks, Bicep deployments, or Pulumi projects managing production infrastructure.
  3. Select a representative sample of 10-15 cloud resources (compute instances, storage buckets, databases, network components) from production environments using cloud provider APIs or console queries.
  4. For each sampled resource, trace its provisioning history by examining resource tags, CloudTrail/Activity Log events, or deployment metadata to determine whether it was created via IaC or manual console operations.
  5. Review git commit history for the IaC repositories over the past 90 days to verify that infrastructure changes undergo pull request workflows with documented approvals.
  6. Execute IaC drift detection commands (terraform plan, CloudFormation drift detection, or equivalent) against production environments to identify resources modified outside of IaC workflows.
  7. Interview DevOps and infrastructure engineers to document the process for emergency or break-glass scenarios where manual changes might be permitted and how such changes are reconciled into IaC.
  8. Examine CI/CD pipeline configurations to confirm that IaC deployments include automated security scanning (tfsec, Checkov, CloudFormation Guard) and that failed scans block deployments.
Evidence required Collect screenshots or exports of IaC repository structures showing production infrastructure code, git commit logs with approval workflows for the past quarter, and drift detection reports from terraform plan or cloud-native drift detection tools. Obtain CloudTrail/Activity Log excerpts showing resource creation events with source identifiers indicating IaC tooling versus console-based actions. Capture CI/CD pipeline configuration files demonstrating integrated security scanning and approval gates for infrastructure deployments.
Pass criteria At least 95% of sampled production cloud resources are provisioned and managed through version-controlled IaC tooling, drift detection shows no unapproved manual changes in the past 30 days, and all infrastructure code changes undergo documented peer review and approval processes.