GuideIntermediate

Cloud Security And Guardrails

This guide takes the Andes Cargo Terraform project and pipeline left working by the three previous guides and teaches that a green pipeline is not a secure pipeline. It starts with threat modeling using the STRIDE framework applied to Andes Cargo's real infrastructure inventory, producing a threat model document that governs the rest of the guide. It builds real federated OIDC identity infrastructure (the identity provider, a least-privilege trust policy) against LocalStack, honest about the exact limit of what a free lab can validate for a real token, and tightens Andes Cargo's existing IAM roles to least privilege. It migrates secrets from a plain-text file to SSM Parameter Store and Secrets Manager, and scans the repository for leaked credentials. The guide's executed core is preventive policy-as-code: writing Rego policies with `conftest`/OPA that evaluate a Terraform `plan` before it can even be applied, replacing the handmade guardrail built in the CI/CD guide. It adds static IaC scanning with Trivy and Checkov, and real software supply chain work: generating an SBOM and signing/verifying a deployment artifact with `cosign`, fully offline, demonstrating that verification actually catches tampering. It closes by distinguishing preventive from detective guardrails and chaining `conftest` → Trivy → `cosign` into a real security gate inside the inherited pipeline, tested with a change that passes and one that gets stopped before applying.