SECAI Core · phase 12 of 15
Infrastructure as code
Provisioning architecture in which deployment of resources is performed by scripted automation and orchestration.
The Explain card
- Plain English
- Infrastructure as code provisions servers, networks, and services through scripted automation and orchestration rather than manual clicks, so the infrastructure is defined in version-controlled files.
- Example
- An ML platform's GPU clusters, storage buckets, and IAM roles are declared in Terraform. A pull request that opens a training bucket to the public is caught in code review before it ever deploys.
- Why it matters
- Reviewable, testable infrastructure means misconfigurations are visible and reversible. Defenders can scan IaC for weaknesses and rebuild compromised environments from a known-good definition.
- Hook
- Your data center, in a file you can diff.
Where it sits in the deck
Phase 12: Defensive Technologies and Secure Development Practices
Map defences directly to the attacks just catalogued — the technical controls, secure coding practices, and protective tools that harden AI and traditional systems alike.
