Security Fundamentals for Architecture as Code

All courses / Architecture as Code / Module 3 / Chapter 9

Learning objectives

After the lesson the participant can:

• Explain the shift from perimeter protection to Zero Trust Architecture and what trust as code means.
• Apply the six STRIDE categories to infrastructure definitions, pipelines and secrets management.
• Describe the stages of the secrets lifecycle and why infrastructure state is a sensitive artefact.
• Break a high-level control objective into declarative assertions that can be executed in a pipeline.

Key concepts

Zero Trust Architecture

Security thinking guided by the principle never trust, always verify: every user, device and network transaction is validated explicitly regardless of location or prior authentication. Declared in code, it yields what the chapter calls trust as code.

STRIDE for code-based architectures

A structured framework of six threat categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service and Elevation of Privilege. In Architecture as Code it must also cover infrastructure definitions, deployment pipelines, secrets management and runtime environments.

Continuous risk assessment

Risk evaluation embedded in the development life cycle through automated tooling and policy engines, so that every infrastructure change is assessed before deployment. Blast radius can be calculated automatically from dependency mapping.

Secrets lifecycle management

Management of secrets from generation through distribution, rotation and retirement, with automated generation, delivery through secure channels or runtime injection, and central storage encrypted in transit and at rest.

Micro-segmentation

Granular, application-aware network control in which traffic policies use application identity, user context and data classification, reducing opportunities for lateral movement compared with traditional VLANs or subnets.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. The chapter argues that manual security reviews as gateways frustrate teams and delay releases. What has to be automated before a security team can credibly act as an enabler?
2. Why does threat modelling for Architecture as Code have to include the CI/CD pipeline and the automation tooling as attack surfaces?
3. Where does human judgement remain essential in data classification, according to the chapter, and how would you combine it with automated discovery?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. Which guiding principle does the chapter give for Zero Trust Architecture?

   1. Trust the internal network, verify the external one
   2. Never trust, always verify
   3. Verify once at the perimeter, then trust the session
   4. Trust owned devices
   Show the answer

   B. Never trust, always verify
   Zero Trust Architecture is guided by never trust, always verify, requiring explicit validation of every user, device and network transaction regardless of location or prior authentication.

2. In the chapter's STRIDE table, which concern is listed under Repudiation?

   1. Secrets stored in code repositories
   2. Stolen credentials for a service account
   3. Resource exhaustion through misconfiguration
   4. Missing version control history and untracked deployments
   Show the answer

   D. Missing version control history and untracked deployments
   Repudiation is denying actions without a proper audit trail; the listed concerns are missing version control history, inadequate logging of infrastructure changes and untracked deployments.

3. Why does the chapter say infrastructure state files must be treated as sensitive artefacts?

   1. They capture live inventories, secrets and enforced policy decisions
   2. They are the only copy of the application source code
   3. They are required by auditors in their original, unmodified binary form
   4. They cannot be regenerated once a deployment has completed
   Show the answer

   A. They capture live inventories, secrets and enforced policy decisions
   State files capture live inventories, secrets and the policy decisions enforced across environments, so the baseline is a remote backend, locking during writes and restricted access.