> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Infrastructure as Code (IC)

- URL: /taxonomies/software-factory/infrastructure-as-code/
- Published: 2026-10-31T13:00:00.000Z
- Updated: 2026-10-29T12:58:19.673Z
- Description: Infrastructure as Code (IC): 13 threats in the software factory threat taxonomy, each with a mitigation principle and design measures.
- Author: Brett Crawley

[Taxonomies](/taxonomies/) › [Software factory](/taxonomies/software-factory/) › Infrastructure as Code

**Station 13 of 17 · Line 2, Artifact to Runtime · 13 threats · prefix IC**

Infrastructure as code makes the estate reviewable, and makes whoever runs the code the owner of the estate. These cards cover Terraform and OpenTofu, Pulumi, CloudFormation and configuration management, their state, modules and providers, and the plan and apply pipeline.

**Scope:** Terraform and OpenTofu, Pulumi, CloudFormation, Ansible; state, modules, providers, plan and apply.

![Table: Infrastructure as Code (IC), 13 threats with their mitigation principles and design measures. The full text is in the PDF and Excel downloads on the software factory taxonomy overview page.](https://www.ostering.com/media/posts/116/taxonomy-table-13-IC.png =1400x4724)

*Text version: every entry on this page is in the [PDF and Excel downloads](/taxonomies/software-factory/) on the overview page, where it can be searched and copied.*

## The threats

- <span id="ic-a"></span>**IC·A** State File Exposure
- <span id="ic-k"></span>**IC·K** Plan-Time Code Execution
- <span id="ic-q"></span>**IC·Q** Malicious Module or Provider
- <span id="ic-j"></span>**IC·J** Over-Privileged Apply Identity
- <span id="ic-10"></span>**IC·10** Plan and Apply Divergence
- <span id="ic-9"></span>**IC·9** Configuration Controller
- <span id="ic-8"></span>**IC·8** Drift and Out-of-Band Change
- <span id="ic-7"></span>**IC·7** Secrets in Variables and Output
- <span id="ic-6"></span>**IC·6** Insecure Defaults Propagated
- <span id="ic-5"></span>**IC·5** Destructive Change
- <span id="ic-4"></span>**IC·4** Orphaned Resources
- <span id="ic-3"></span>**IC·3** Cross-Workspace Reach
- <span id="ic-2"></span>**IC·2** State Locking and Corruption

## Seen in the wild

- **IC·6 Insecure Defaults Propagated:** IaC security smells (Rahman et al., 2019).

Sources for each case are listed on the [overview page](/taxonomies/software-factory/).

## STRIDE, CAPEC and CWE

Of the 13 entries here, STRIDE fits 11 cleanly and 2 only loosely. CAPEC 3.9 has a pattern that describes 3 of them directly, only a generic parent pattern for 9, and nothing for 1. CWE 4.20 names the weakness directly for 7, has only a broader weakness for 4, and nothing for 2. The table below gives the mapping entry by entry, with the names of the CAPEC patterns and CWE weaknesses; what the mapping shows across the whole taxonomy is in [Mapping the Software Factory Threat Taxonomy to STRIDE, CAPEC and CWE](/mapping-the-software-factory-threat-taxonomy/). The Excel, SKOS and STIX downloads carry the same mapping as text.

![Table: STRIDE, CAPEC and CWE mapping for Infrastructure as Code (IC), 13 threats, with each entry's STRIDE categories and fit, CAPEC 3.9 patterns and CWE 4.20 weaknesses. The full mapping is in the Excel, SKOS and STIX downloads on the software factory taxonomy overview page.](https://www.ostering.com/media/posts/116/software-factory-mapping-table-13-IC.png =1400x2172)

---

← [SBOM and VEX (BM)](/taxonomies/software-factory/sbom-and-vex/) · [Software factory overview](/taxonomies/software-factory/) · [Container Images (IM)](/taxonomies/software-factory/container-images/) →

*© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [software factory overview](/taxonomies/software-factory/).*