Hacking Terraform State for Privilege Escalation
Modifying a Terraform state file allows attackers to delete infrastructure or execute code via custom providers.
- from
- CI/CD Attacks
- added
- 2026-10-10
- likes
- 0
similar
-
Erosion of Trust: Unmasking Supply Chain Vulnerabilities in the Terraform Registry boostsecurity.io
Terraform modules are not protected by the Dependency Lock File, consequently, a seemingly harmless module could potentially introduce malicious code.
-
Terraform Security Guide sysdig.com
Blog post describing security best practices when working with Terraform
-
Two Weeks with Terraform charity.wtf
Some hard-earned experience from using Terraform in the wild, and some operational wisdom.
-
DevOpsLesson Terraform Playground devopslesson.com
Free browser-based Terraform simulator with guided HCL exercises and practice commands.
-
Terraform in Action manning.com
-
Emacs terraform-mode github.com
CI/CD Attacks › Techniques > Post Exploitation: “Modifying a Terraform state file allows attackers to delete infrastructure or execute code via custom providers.”