Answers

Here are the answers to this chapter’s questions:

1. Repository management centralizes the control of IaC templates, akin to source code management. It facilitates collaboration, version control, and automated security scanning upon each commit, serving as an early detection system for potential security issues.
2. Static code analysis involves scanning the IaC code for patterns that could lead to security issues, such as open security groups or hard-coded secrets. It is crucial for early detection of vulnerabilities and ensuring adherence to security best practices.
3. Dynamic analysis is performed on the actual provisioned infrastructure, as opposed to the static code. It validates the security of deployed resources in a live environment, which is essential for catching issues that static analysis might miss.
4. To prevent privilege escalation, organizations should architect their systems so that tasks are associated with distinct roles and not the permissions...