INFRA-10 Infrastructure as Code

What is INFRA-10 Infrastructure as Code Control?

Infrastructure as Code (IaC) is about managing the infrastructure through code instead of a manual process. If your organization is managing infrastructure through code, it must be documented in your policy.

Available tools in the marketplace

The following listing is “crowdsourced” from our customer base or from external research. TrustCloud does not personally recommend any of the tools below, as we haven’t used them.

Infrastructure as Code (IaC) Tools

Terraform

AWS Cloud Formation

Azure Resource Manager

Google Cloud Deployment Manager

Chef

Puppet

Available templates

TrustCloud has a curated list of templates, internally or externally sourced, to help you get started. Click on the link for a downloadable version:

• N/A: no template for this section

Control implementation

NOTE: This control is 100% automated by TrustCloud. Connect your system to enjoy the benefits of automation.

To implement this control manually,

Implement an IaC tool and consider the following:

• Keep and maintain a configuration file.
• Version control on all configuration files
• Regularly test and monitor the configurations.

If the IaC tool is not used:

• Document your IaC code change process in your change management policy and follow the code change process for each infrastructure code change.

What evidence do auditors look for?

Most auditors, at a minimum, are looking for the below-suggested action:

1. Provide the IaC configuration file that shows the version control and latest test

If the IaC tool is not used:

1. Provide most recent example of infrastructure code change ticket documentation

Evidence example

For the suggested action, an example is provided below:

1. Provide the IaC configuration file that shows the version control and latest test.
   The following screenshot shows an IaC configuration, providing the full configuration file to the auditor.
   Google search
   
2. Provide the most recent example of infrastructure code change ticket documentation.

• See screenshots under PDP-8