iac-securitylisted

<!-- Native skill bundle for Claude Code. Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/iac-security/SKILL.md. --> # Infrastructure-as-Code Security Hardening rules for Terraform, CloudFormation, and Pulumi: state, providers, drift, secrets ## ALWAYS - Pin every provider/module to an exact version or a pessimistic constraint (`~> 5.42`); never `>= 0` or unpinned `latest`. - Configure a **remote backend** with encryption at rest, server-side state locking, and versioning (Terraform: `s3` + DynamoDB lock table with `kms_key_id`; Pulumi: the managed backend or `s3://?kmskey=`; CloudFormation: managed by AWS). - Encrypt every persistent resource by default with a customer-managed KMS key: S3 buckets, EBS volumes, RDS, EFS, DynamoDB, SQS, SNS, CloudWatch log groups. - Tag every resource with `owner`, `environment`, `cost-center`, and `data-classification` via a default tags block. - Run `terraform plan` (or `pulumi preview`, `aws cloudformation deploy --no-execute-changeset`) in CI and require a human approval before `apply` on production stacks. - Add a drift-detection job that runs daily and opens an issue when actual cloud state diverges from code (Terraform Cloud drift detection, `pulumi refresh`, `cfn-drift-detect`). - Use IAM Conditions to scope every role: `aws:SourceArn`, `aws:SourceAccount`, `aws:PrincipalOrgID`, and TLS-only access policies on storage. ## NEVER - Hardcode provider credentials in the code or `