Who Watches the Watchmen? Stealing Credentials from Policy-as-Code Engines […] ~ Shelly Raban

### Overview In this talk, Shelly Raban, a senior cloud security researcher at Tenable, examines the security risks residing within policy-as-code (PAC) engines and infrastructure-as-code (IAC) tooling. While organizations widely rely on these systems to govern deployments and enforce security compliance, Raban demonstrates how malicious actors can exploit the supply chain of policies and configurations to execute arbitrary code, query internal endpoints, and exfiltrate sensitive cloud credentials.

### Key Topics - **Policy-as-Code & IAC Workflow Supply Chain Risks:** How policy engines such as Open Policy Agent (OPA) and IAC frameworks such as Terraform introduce attack vectors when third-party or untrusted code is ingested. - **Malicious Use of OPA Rego Built-ins:** Abusing default capabilities in Rego to interact with network services, query the AWS Instance Metadata Service (IMDS), and tunnel secrets out via DNS. - **Terraform Plan Execution Risks:** Dispelling the misconception that the Terraform `plan` stage is read-only, highlighting that external data sources and provisioners execute code and network calls before `apply`. - **Ecosystem and Scanner Blind Spots:** Scanning the public Terraform Registry for anomalous data source blocks and reviewing how common static scanners (Checkov, Trivy, KICS) fail to address these risks.

### Technical Details - **OPA and Rego Exploitation:** - In a scenario where an attacker obtains write access to an S3 bucket storing OPA policies, malicious Rego rules run during routine policy evaluations. - Built-in functions like `opa.runtime` (fetching environment variables) and `http.send` (transmitting network requests) can leak credentials. Raban proved that even if direct environment variables are blocked, `http.send` can target the EC2 IMDS to steal IAM credentials. - When HTTP egress is restricted, Raban utilized the `net.lookup_ip_addr` built-in to exfiltrate hardcoded secrets and access keys through DNS tunneling via subdomains of an attacker-controlled domain. - Raban also disclosed a vulnerability reported to Styra: providing a UNC path instead of a Rego file on Windows caused OPA to authenticate over SMB to a remote share, leaking logged-in NTLM credentials. - **Terraform Plan-Time Abuse:** - Terraform modules do not require custom Go-based compiled providers to execute malicious logic; built-in HCL data sources execute at `plan` time. - Attackers can employ the `http` data source to send HCL variables externally, the `external` data source to execute arbitrary host commands (such as `env`), and provisioners (`local-exec`, `remote-exec`) to stage payloads or miners. - Testing IMDS credential extraction with Terraform's `http` data source failed because IMDSv2 requires the `PUT` method, whereas the Terraform `http` data source only supports `GET`, `HEAD`, and `POST`. - DNS tunneling was similarly replicated in Terraform using the `dns` data source. - **Registry Analysis & Scanner Deficiencies:** - Scanning the public Terraform Registry with Python scripts showed that `dns` and `external` data sources are rare anomalies across public modules. - One public POC module exhibiting anomalous outbound parameters had nearly 3,000 downloads and displayed an official AWS provider badge despite carrying data exfiltration logic. - Evaluation of popular IAC scanners (Checkov, Trivy, KICS) showed poor detection of exfiltration patterns, with some tools suggesting misguided remediations like switching cleartext HTTP leaks to HTTPS.

### Takeaways - **Scan Before You Plan:** Treat the `plan` phase of Terraform as an active execution stage rather than a safe read-only preview. Static security inspection must occur before `terraform plan` is executed. - **Principle of Least Privilege:** Enforce strict RBAC on buckets storing policies, decouple plan and apply IAM roles, and restrict machine network access and metadata service configurations (e.g., enforcing IMDSv2). - **Restrict OPA Capabilities:** Leverage OPA's capabilities feature to restrict dangerous built-in functions like `http.send` and network lookups. - **Anomaly Hunting:** Monitor configurations for rare data sources such as `external` and `dns` blocks to identify potential malicious payloads without introducing widespread alert fatigue.