Enhanced infrastructure as code security
A method includes receiving, at a server, an authorizing request pertaining to authorization of future modification to a plurality of computing resources of a computing resource environment, the authorizing request comprising first credentials and an authorization value that is based on a first computing resource environment configuration file and a second computing resource environment configuration file. The method includes, responsive to a validation of the first credentials, storing the authorization value in a datastore. The method includes, receiving, at the server, a modification request comprising second credentials and comparing the modification request to the stored authorization value. The method further includes, responsive to the modification request matching the stored authorization value and a validation of the second credentials, modifying the plurality of computing resources of the computing resource environment based on the first computing resource environment configuration file and the second computing resource environment configuration file.
1 . A method comprising:
receiving, at a server, an authorizing request pertaining to authorization of future modifications to a plurality of computing resources of a computing resource environment, the authorizing request comprising first credentials and an authorization value that is based on a first computing resource environment configuration file and a second computing resource environment configuration file;
responsive to a validation of the first credentials, storing the authorization value in a datastore;
receiving, at the server, a modification request comprising second credentials;
comparing the modification request to the stored authorization value; and
responsive to the modification request matching the stored authorization value and a validation of the second credentials, modifying the plurality of computing resources of the computing resource environment based on the first computing resource environment configuration file and the second computing resource environment configuration file.
2 . The method of claim 1 , wherein the first computing resource environment configuration file has been modified subject to validation of third credentials, and wherein the second computing resource environment configuration file has been modified subject to validation of fourth credentials, wherein the third credentials and the fourth credentials are different.
3 . The method of claim 1 , wherein the authorization value comprises a first encrypted hypertext transfer protocol (HTTP) request based on the first computing resource environment configuration file and the second computing resource environment configuration file.
4 . The method of claim 3 , wherein the first encrypted HTTP request is generated by a source control and encrypted by a key management system (KMS).
5 . The method of claim 4 , wherein the modification request further comprises a second encrypted HTTP request received from the source control.
6 . The method of claim 1 , wherein the authorization value comprises a first encrypted hash based on a hash of an HTTP request based on the first computing resource environment configuration file and the second computing resource environment configuration file.
7 . The method of claim 6 , wherein the comparing the modification request to the stored authorization value comprises:
retrieving the stored authorization value from the datastore;
decrypting the first encrypted hash of the stored authorization value to obtain a decrypted hash;
calculating a second hash based on at least a portion of the modification request; and
comparing the decrypted hash to the second hash.
8 . A system comprising:
a memory device; and
a processing device coupled to the memory device, the processing device to perform operations comprising:
receiving, at a server, an authorizing request pertaining to authorization of future modifications to a plurality of computing resources of a computing resource environment, the authorizing request comprising first credentials and an authorization value that is based on a first computing resource environment configuration file and a second computing resource environment configuration file;
responsive to a validation of the first credentials, storing the authorization value in a datastore;
receiving, at the server, a modification request comprising second credentials;
comparing the modification request to the stored authorization value; and
responsive to the modification request matching the stored authorization value and a validation of the second credentials, modifying the plurality of computing resources of the computing resource environment based on the first computing resource environment configuration file and the second computing resource environment configuration file.
9 . The system of claim 8 , wherein the first computing resource environment configuration file has been modified subject to validation of third credentials, and wherein the second computing resource environment configuration file has been modified subject to validation of fourth credentials, wherein the third credentials and the fourth credentials are different.
10 . The system of claim 8 , wherein the authorization value comprises a first encrypted hypertext transfer protocol (HTTP) request based on the first computing resource environment configuration file and the second computing resource environment configuration file.
11 . The system of claim 10 , wherein the first encrypted HTTP request is generated by a source control and encrypted by a key management system (KMS).
12 . The system of claim 11 , wherein the modification request further comprises a second encrypted HTTP request received from the source control.
13 . The system of claim 8 , wherein the authorization value comprises a first encrypted hash based on a hash of an HTTP request based on the first computing resource environment configuration file and the second computing resource environment configuration file.
14 . The system of claim 13 , wherein the comparing the modification request to the stored authorization value comprises:
retrieving the stored authorization value from the datastore;
decrypting the first encrypted hash of the stored authorization value to obtain a decrypted hash;
calculating a second hash based on at least a portion of the modification request; and
comparing the decrypted hash to the second hash.
15 . A non-transitory computer-readable storage medium comprising instructions that, when executed by a processing device, cause the processing device to perform operations comprising:
receiving, at a server, an authorizing request pertaining to authorization of future modifications to a plurality of computing resources of a computing resource environment, the authorizing request comprising first credentials and an authorization value that is based on a first computing resource environment configuration file and a second computing resource environment configuration file;
responsive to a validation of the first credentials, storing the authorization value in a datastore;
receiving, at the server, a modification request comprising second credentials;
comparing the modification request to the stored authorization value; and
responsive to the modification request matching the stored authorization value and a validation of the second credentials, modifying the plurality of computing resources of the computing resource environment based on the first computing resource environment configuration file and the second computing resource environment configuration file.
16 . The non-transitory computer-readable storage medium of claim 15 , wherein the first computing resource environment configuration file has been modified subject to validation of third credentials, and wherein the second computing resource environment configuration file has been modified subject to validation of fourth credentials, wherein the third credentials and the fourth credentials are different.
17 . The non-transitory computer-readable storage medium of claim 15 , wherein the authorization value comprises a first encrypted hypertext transfer protocol (HTTP) request based on the first computing resource environment configuration file and the second computing resource environment configuration file.
18 . The non-transitory computer-readable storage medium of claim 17 , wherein the first encrypted HTTP request is generated by a source control and encrypted by a key management system (KMS).
19 . The non-transitory computer-readable storage medium of claim 15 , wherein the authorization value comprises a first encrypted hash based on a hash of an HTTP request based on the first computing resource environment configuration file and the second computing resource environment configuration file.
20 . The non-transitory computer-readable storage medium of claim 19 , wherein the comparing the modification request to the stored authorization value comprises:
retrieving the stored authorization value from the datastore;
decrypting the first encrypted hash of the stored authorization value to obtain a decrypted hash;
calculating a second hash based on at least a portion of the modification request; and
comparing the decrypted hash to the second hash.