Infrastructure-as-code is a huge win: your environment is versioned, repeatable, and reviewable. It also means that if you encode one insecure default, you deploy it perfectly, every time, everywhere.
Default credentials in Compose
A docker-compose.yml with POSTGRES_PASSWORD: postgres is fine on your laptop and a gift to an attacker in production. Copied service definitions carry these defaults straight into deployment.
Ports open to the world
Binding a database or admin service to 0.0.0.0 instead of localhost exposes it to the internet. In Terraform, an overly broad security-group rule (0.0.0.0/0 on a database port) does the same thing, quietly, in a file nobody re-reads.
The danger of IaC is not that it is hard. It is that it deploys your mistakes flawlessly.
The usual suspects
- Hardcoded secrets in environment blocks and variable files.
- Containers running as root when they do not need to.
- Storage buckets set to public.
- Debug or management ports exposed beyond localhost.
Scan the config, not just the code
Application scanners look at your source. Your infrastructure is code too, and it deserves the same scrutiny. Scanning your Dockerfiles, Compose files, and Terraform for default creds and open rules before you apply them is the cheapest infrastructure security you will ever buy.