Module 09: Security and Infrastructure as Code

Goal

Treat security and repeatable infrastructure as core engineering skills, not final cleanup tasks.

Security Topics

• IAM and RBAC.
• Least privilege.
• Network segmentation.
• Encryption at rest.
• Encryption in transit.
• Key management.
• Secrets management.
• Logging and audit trails.
• SIEM concepts.
• Data classification.
• Data retention.
• Human oversight.

AI Security Topics

• Prompt injection.
• Data exfiltration.
• Tool abuse.
• Excessive agency.
• Model manipulation.
• Sensitive data leakage.
• Retrieval poisoning.
• Insecure output handling.
• Agent authorization.

Infrastructure as Code Topics

• Terraform providers.
• Variables.
• Modules.
• State.
• Remote state.
• Environments.
• Secrets.
• Plan/apply workflow.

Study Tasks

• Write a threat model for a RAG system.
• Write a threat model for an agent system.
• Create least-privilege tool permissions.
• Add prompt injection test cases.
• Create Terraform modules for network, compute, database, and secrets.
• Create separate dev and production environments.
• Write a disaster recovery plan.

Tips

• Security must be enforced in code and infrastructure, not only prompts.
• Use deny-by-default permissions.
• Store secrets in managed secret systems.
• Review every agent tool as if it were a public API.

Completion Checklist

• Can explain least privilege.
• Can build a threat model.
• Can detect prompt injection risks.
• Can write basic Terraform modules.
• Can separate environments safely.