HACKING TERRAFORM STATE FOR PRIVILEGE ESCALATION

Summary from the TLDR InfoSec newsletter

Terraform can be configured to store state files in a remote backend. This post looks at how attackers can leverage compromised state files. It begins by demonstrating how an attacker could cause AWS resource deletion by confusing a Terraform user into applying a modified state file that results in resource deletion. It then goes on to demonstrate the process of writing and publishing a malicious Terraform provider that can execute code upon Terraform plan or apply and then demonstrates how this can be combined with state file modification to hijack CI/CD systems.