auditing-infrastructure-as-code-exposureslisted

# Auditing infrastructure-as-code exposures: what the definition would actually provision Infrastructure-as-code is desired state, so the bug is not what a line says but what the resource becomes once variables resolve, modules compose, and account defaults apply. A bucket ACL that reads public may be overridden by an account block, and a security group open to the internet may sit in a private subnet nothing routes to. This audit reads the definition and asks one question per resource: once applied, does this provision a resource that violates its security baseline, least exposure, encryption on, least privilege, logging on, no plaintext secret. Everyone has the checklist; the work that matters is adjudicating the effective config and killing the finding that a different layer already neutralizes. Anchor on auditing what exists, not generating or refactoring it. ## When to use - You have Terraform, OpenTofu, CloudFormation, Bicep, or Pulumi definitions for infrastructure in scope. - A resource block declares storage, a network rule, an identity or resource policy, encryption, or logging. - You want to know which blocks would provision an insecure resource once applied, not just which lines look wrong. ## Scope check Audit only definitions for infrastructure you own or are authorized to assess, and never apply a definition or mutate a live account to test a finding, adjudicate on the resolved config, not by provisioning. If you can't name the authorization, stop. ## The