GITFLOPS: THE DANGERS OF TERRAFORM AUTOMATION PLATFORMS

Summary from the TLDR InfoSec newsletter

Terraform automation platforms like Atlantis and Terraform Cloud are very popular for creating pull-request based CI/CD workflows. The typical workflow involves opening a pull-request that will trigger a read-only terraform plan which will then be reviewed and can be applied by a more privileged user with a comment. A malicious user can either inject code via the entry point of a malicious provider or through a malicious data source to bypass the read-only protections of terraform plan. This vulnerability has been confirmed on five Terraform automation platforms.