Skip to content

Instantly share code, notes, and snippets.

@bparanj
Created June 9, 2026 00:37
Show Gist options
  • Select an option

  • Save bparanj/bd495820cf0c9ec60fdb38728e35c152 to your computer and use it in GitHub Desktop.

Select an option

Save bparanj/bd495820cf0c9ec60fdb38728e35c152 to your computer and use it in GitHub Desktop.

The divide between "application code" and "infrastructure configuration" is a legacy mental model that no longer fits the cloud-native world. To reason about security effectively, one must view them as a single, unified system.

Here is a summary of the concepts that bridge these two sides of the same coin:

1. The Execution Context (The "Where" vs. The "How")

Code describes the logic of how data is processed, but configuration defines the environment where that logic lives. You cannot determine if a piece of code is "safe" without knowing its context. For example, a piece of code with a known vulnerability is a critical risk if configuration places it on a public-facing subnet, but a low risk if it is isolated in a private, non-routed environment.

2. Identity and Entitlement (The "Who")

In the cloud, Identity is the new perimeter. Application code performs actions (like reading an S3 bucket), but the configuration (IAM policies) dictates whether the code has the permission to do so. A security audit that only looks at code won't see that the application has "Admin" rights, and an audit that only looks at IAM won't see that the code contains a Server-Side Request Forgery (SSRF) vulnerability that allows an attacker to abuse those rights.

3. Data Flow and Persistence

Code handles the transit of data, but configuration defines its residency and protection (encryption at rest, backup policies, and cross-region replication). Security is lost when there is a mismatch: code might encrypt data perfectly, but if the configuration stores it in a world-readable bucket, the code’s logic is irrelevant.

4. Infrastructure as Code (IaC) Convergence

The distinction has blurred technically because configuration is now literally written as code (Terraform, Pulumi, CloudFormation). Since configuration now uses loops, variables, and logic, it is subject to the same types of bugs as application code—such as hardcoded secrets, logic errors, and injection vulnerabilities.

5. The "Blast Radius" Logic

Configuration defines the boundaries of a breach. While code determines how a system might be breached, configuration determines how far the attacker can go once they are inside. You cannot reason about the "Blast Radius" of a vulnerability without analyzing the network security groups, VPC peering, and service roles defined in the configuration.

6. Secrets Management

The bridge between code and configuration is often the "Secret." Code requires a password to access a database; configuration defines how that password is injected (Environment variables, Secret Managers, or Key Vaults). A failure in either—such as hardcoding the secret in the code or misconfiguring the vault's access policy—results in the same total compromise.

7. Holistic Threat Modeling

True security reasoning requires a "Graph" approach. You must be able to trace a path from a line of code, through the container it sits in, to the virtual network it inhabits, and finally to the IAM role it assumes. If you treat these as separate silos, you leave "shadow gaps" where an attacker can hide between the application logic and the cloud settings.

Summary

Code is the engine, and Configuration is the tracks. To ensure a safe journey, you cannot inspect the engine while ignoring the state of the tracks, nor can you certify the tracks as safe without knowing the weight and speed of the engine running upon them.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment