  Cloud computing has become popular thanks to the widespread use of
Infrastructure as Code (IaC) tools, allowing the community to conveniently
manage and configure cloud infrastructure using scripts. However, the scripting
process itself does not automatically prevent practitioners from introducing
misconfigurations, vulnerabilities, or privacy risks. As a result, ensuring
security relies on practitioners understanding and the adoption of explicit
policies, guidelines, or best practices. In order to understand how
practitioners deal with this problem, in this work, we perform an empirical
study analyzing the adoption of IaC scripted security best practices. First, we
select and categorize widely recognized Terraform security practices
promulgated in the industry for popular cloud providers such as AWS, Azure, and
Google Cloud. Next, we assess the adoption of these practices by each cloud
provider, analyzing a sample of 812 open-source projects hosted on GitHub. For
that, we scan each project configuration files, looking for policy
implementation through static analysis (checkov). Additionally, we investigate
GitHub measures that might be correlated with adopting these best practices.
The category Access policy emerges as the most widely adopted in all providers,
while Encryption in rest are the most neglected policies. Regarding GitHub
measures correlated with best practice adoption, we observe a positive, strong
correlation between a repository number of stars and adopting practices in its
cloud infrastructure. Based on our findings, we provide guidelines for cloud
practitioners to limit infrastructure vulnerability and discuss further aspects
associated with policies that have yet to be extensively embraced within the
industry.
