Security as Code
Architecture & DesignSecurity as Code means defining, deploying, and managing security controls through code rather than manual configuration. It brings the benefits of software engineering (version control, testing, CI/CD) to security.
What to Codify
- IAM Policies: version-controlled in Git, deployed via CI/CD
- SCPs: organization guardrails managed as code
- Security Group Rules: network access defined in CloudFormation/Terraform
- Config Rules: compliance checks as Lambda functions or CloudFormation Guard
- WAF Rules: web application firewall rules as code
- Detective Controls: GuardDuty custom threat lists, EventBridge rules for automation
Benefits
- Reproducibility: identical security posture across all environments
- Auditability: Git history shows who changed what and when
- Testability: validate security policies in CI before deployment
- Speed: security controls deploy alongside application code
- Drift Detection: Config/CloudFormation detect when reality diverges from code
Related Terms
Managing and provisioning cloud infrastructure through machine-readable configuration files instead of manual processes, enabling version control, repeatability, and security review.
A security strategy using multiple layers of controls (network, identity, data, application) so that if one layer fails, others still protect the environment.
A preventive or detective control that enforces security boundaries across AWS accounts, implemented through SCPs, AWS Config rules, or Security Hub standards.
An organization-wide guardrail that restricts what actions member accounts can perform, regardless of their IAM policies.
Managed or custom rules that continuously evaluate AWS resource configurations against desired settings, flagging non-compliant resources automatically.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.