Exercises: Security and IaC

Concept Drills

• Explain least privilege.
• Explain encryption in transit and at rest.
• Explain secret management.
• Explain prompt injection and retrieval poisoning.

Build Drills

• Create a threat model for RAG.
• Create a threat model for agents.
• Write a permission matrix.
• Create Terraform variables and modules.
• Create separate dev and production environment structure.
• Write disaster recovery notes.

Failure Drills

• Test prompt injection.
• Test unauthorized document access.
• Test unauthorized tool access.
• Simulate leaked secret response.

Output

• Threat model.
• Permission matrix.
• Terraform skeleton.
• Security checklist results.