Why it matters in practice
Within Cloud Offensive Security, IaC, Pipelines and Cloud Drift changes how scope, prerequisites and evidence should be handled. Focus on the concrete asset or data flow under test, record the assumptions that make the condition exploitable and connect verified behavior to an operational consequence and remediation decision.
Primary coverage
- Look for secrets, state files and plan artifacts before you look for RCE in cloud hosts.
- Review who can approve, merge, apply or override pipeline gates.
- Compare declared permissions to runtime permissions; drift often exposes what defenders stopped tracking.
- Consider GitOps controllers and deployment robots as privileged cloud identities.
Assessment focus
For IaC, Pipelines and Cloud Drift, document the starting condition, tested action, observable result and any constraint that limited validation. Separate what was proven from what remains inferred, then tie each recommendation to the control boundary described in the evidence.
Selected public references
- Terraform StateState handling and sensitive material risk.
- GitHub Actions Security HardeningWorkflow permissions and runner trust.
- SigstoreArtifact signing and provenance context.