APRA CPS 230 compliance with The Infrastructure Cloud from HashiCorp

APRA requirement

How HashiCorp helps

Operational risk management

25

In managing technology risks, an APRA-regulated entity must monitor the age and health of its information assets and meet the requirements for information security in Prudential Standard CPS 234 Information Security (CPS 234).

While HashiCorp does not provide an asset management solution, HashiCorp Terraform tracks the creation and modification times of resources which can be used to infer the age of IT assets such as applications in the cloud, while HashiCorp Packer can also be used to build and (through Terraform) manage the lifecycle of machine images.

HashiCorp Consul can be utilised to help monitor the health of services running on your IT assets, providing insights into their operational status. Consul provides a registry for services, tracking all the services running in cloud infrastructure and their locations. Consul also allows health checks to be defined for each service, which could be anything from an HTTP endpoint to a script that runs on the service itself. Consul will continuously monitor the health of services using these checks and report discrepancies to a monitoring dashboard or alerting system to provide a comprehensive view of service health.

The APRA CPS 234 Information Security, via its Prudential Practice Guide, CPG 234, is also covered in this document.

26

An APRA-regulated entity must include an assessment of … the impact of new products, services, geographies and technologies on its operational risk profile.

Using Terraform, new cloud services are provisioned as secure and resilient by default, through code (infrastructure as code/policy as code principles), without manual processes that can weaken resiliency through human error. This makes the process of introducing new services, geographies or technology changes predictable, thereby making their impact assessment easier.

While HashiCorp doesn’t provide a direct impact assessment service  here, the development of golden images, application and service modules and deployment workflows ensure that assessed and approved services can be adopted easily and enforced through policy as code.

28

An APRA-regulated entity must conduct a comprehensive risk assessment before providing a material service to another party, to ensure that the APRA-regulated entity is able to continue to meet its prudential obligations after entering into the arrangement. APRA may require an APRA regulated entity to review and strengthen internal controls or processes where APRA considers there to be heightened prudential risks in such circumstances.

HashiCorp Vault can be used to provide ephemeral secrets to third-party providers, including managed service providers, by leveraging its dynamic secrets feature. This feature allows Vault to generate short-lived, on-demand credentials that are unique to each application, machine, or user, reducing the risk associated with static, long-term credentials.

Prudential obligations can be met by implementing Vault with the following configurations:

• Generate dynamic or ephemeral secrets that are created on demand for just-in-time access and configure these secrets to expire after a short period.
• Configure namespaces within Vault to provide isolated environments for different teams or services, ensuring least privileged access.
• Use Vault’s various authentication methods to verify the identity of users or services requesting access to secrets.
• Integrate Vault with identity providers and services, ensuring authentication is centralised in Vault and usage can be centrally monitored.
• Enforce centralised policy access management across different platforms, standardising best practices across the organisation.
• Consolidate credentials, and detect and manage secret sprawl across multiple cloud service providers, automating secrets policies across services.
• Setup Vault in multiple regions to support globally distributed applications and reduce latency to secrets.
• Setup disaster recovery enabled Vault clusters to ensure business continuity.

29

An APRA-regulated entity must design, implement, and embed internal controls to mitigate its operational risks in line with its risk appetite and meet its compliance obligations.

HashiCorp contributes to internal controls to mitigate operational risks, with standardised workflows, policy as code, dynamic secrets, infrastructure drift detection, secrets scanning, PII and sensitive data encryption and protection, and OS updates at multi-cloud scale. HashiCorp products offer test and reporting functionality that will include all test results as well as deficiencies. Examples include unauthorised changes, misconfigurations, configuration drift, and unmanaged secrets. This is covered in more detail further on in this document.

30

An APRA-regulated entity must regularly monitor, review and test controls for design and operating effectiveness, the frequency of which must be commensurate with the materiality of the risks being controlled.

HashiCorp products perform logging of all actions and events, providing auditable trails of all changes, uses, outdated versions & image explorer reports, plus Sentinel Policy validation, access audit logs, HashiCorp Boundary active session recording, Vault secret access audit logs and more. All these are ways to identify, record & address risks or potential risks.

Further, codifying infrastructure and security policies as code provides a robust checklist to audit and review to meet this requirement.

32

An APRA-regulated entity must ensure that operational risk incidents and near misses are identified, escalated, recorded, and addressed in a timely manner.

HashiCorp can identify and record risk incidents including where configurations have changed, or secrets have been exposed in code commits:

• Drift detection - Terraform uses declarative configuration files to describe the desired state of infrastructure, then tracks state to detect any discrepancies. These discrepancies are logged and reported, including who made what changes. In addition to reporting and notifying the drift, Terraform also provides a mechanism to roll-back to a stable configuration state of infrastructure with a single click.
• Secrets scanning - Vault Radar Beta operates in real time, scanning for secrets across the organisation’s codebase, alerting teams immediately. Vault Radar Beta can recognise categories and levels of risk for prioritisation and remediation.
• Unpatched operating systems - Terraform can trigger an update of non-compliant images and send notifications to isolate non-compliant images. Additionally, Packer can be integrated in the existing workflows with Ansible, Chef or Puppet to update, deprecate and/or isolate non-compliant images.

APRA requirement

How HashiCorp helps

Business Continuity

41

An APRA-regulated entity must maintain the capabilities required to execute the BCP, including access to people, resources and technology. An APRA regulated entity must monitor compliance with its tolerance levels and report any failure to meet tolerance levels, together with a remediation plan, to the Board.

Terraform enables organisations to define their infrastructure and recovery processes by deploying “infrastructure as code”, and build an automated workflow to remediate at scale. By expressing infrastructure components (such as virtual machines, networks, databases, and load balancers) as code, cloud infrastructure definitions are consistent across environments (development, staging, production), and can be recreated precisely from the code rapidly, reducing manual errors.

Consistency and ease of replication are essential in not only rebuilding infrastructure rapidly, but also building it secure by default with automatically applied policies and thereby APRA regulatory standards. The automation of infrastructure rebuild greatly reduces the need for people in the recovery process, because the rebuild is largely automated and following validated, pre-tested code.

Terraform enables organisations to test BCP in an effective and reliable manner with:

• Automated environment builds with standardised code patterns that produce predictable outcomes every time
• Drift detection, which regularly compares the actual infrastructure with the Terraform code to detect any discrepancies.
• Dry runs, which simulate changes without actually applying them to validate the recovery plan.
• Integration testing, to enable the testing of the entire recovery process end-to-end.
• Security policy, compliance and cost policy validation using Sentinel policy as code framework built into the Terraform runs (plan, apply workflow).
• Applying preventative controls using Sentinel policy as code framework to prevent misconfigurations which could cause security concerns later in the pipeline.

Dynamic DR Environment Creation:

• For traditional DR environments require maintaining separate infrastructure solely for disaster recovery, Terraform can:

• Dynamically create a DR environment on demand. If a disaster strikes, Terraform can rapidly stand up the necessary infrastructure.
• Provision resources across different cloud providers to build DR environments in various regions or different CSP platforms.

infrastructure as code (IaC):

• The foundation of a successful DR strategy with Terraform lies in defining all infrastructure as code, and:

• Zero manual steps should be involved, and instead, the entire infrastructure (networks, servers, databases, etc.) is codified in Terraform.
• If a disaster occurs, the affected components can be rebuilt by applying the Terraform configuration.

Multi-cloud support:

• Terraform supports all major CSPs, including AWS, Google Cloud, Azure, Oracle Cloud, Alibaba, etc., and can:

• Build DR infrastructure on any CSP, ensuring flexibility and avoiding vendor lock-in.
• Support failover to a different cloud provider due to regional outages or other issues.

APRA requirement

How HashiCorp helps

Management of Service Providers

47, 48

[47] An APRA-regulated entity must maintain a comprehensive service provider management policy. The policy must cover how the entity will … manage service provider arrangements, including the management of material risks. 

[48] The policy must include the entity’s approach to entering into, monitoring, substituting and exiting agreements with material service providers; the entity’s approach to managing the risks associated with material service providers; and the entity’s approach to managing the risks associated with any fourth parties that material service providers rely on to deliver a critical operation to the APRA-regulated entity.

Managing Cloud Service Providers (CSPs): With Terraform, organisations can manage their entire infrastructure stack, including the resources provided by external service providers, in a consistent and automated manner. This ensures that the organisation has full control and visibility over its infrastructure, regardless of where it is hosted. Further, organisations can build multi-cloud capabilities into their infrastructure as code to provide the ability to target cloud migration or cloud specific service hosting as needed.

Organisations can use HashiCorp Nomad to automate the deployment and lifecycle management of workloads running on infrastructure provided by external service providers, ensuring that applications are deployed and scaled efficiently and reliably.

Managing secrets: Organisations can use Vault to securely store and manage access to credentials and other secrets required to interact with external service providers. Vault's dynamic secrets feature can generate short-lived credentials on-demand, reducing the risk of unauthorised access and ensuring that access to sensitive data is tightly controlled.

Providing secure remote access: Organisations can use Boundary to manage human access to their entire fleet of servers hosted within external CSPs while maintaining a consistent and common workflow across multiple cloud providers. Boundary’s session recording gives visibility of who connected to which server and what actions were performed during the session.  

Observability: HashiCorp's tools are designed to integrate seamlessly with third-party tools and platforms commonly used for managing service providers, such as cloud management platforms, configuration management tools, SIEM tools, and monitoring and observability platforms.

53

An APRA-regulated entity must:

•     undertake appropriate due diligence, including an appropriate selection process and an assessment of the ability of the service provider to provide the service on an ongoing basis; and

•     assess the financial and non-financial risks from reliance on the service provider, including risks associated with geographic location or concentration of the service provider(s) or parties the service provider relies on in providing the service.”

Using infrastructure as code and policy as code, the right placement of workloads within appropriate region/availability zones can be ensured, including enforced centralised secrets management, ephemeral secrets, encryption and other enforced policies.

Terraform enables organisations to assess and control the configuration of their cloud resources, including geographic location and dependencies on specific service providers. Terraform's declarative configuration language allows organisations to specify the desired state of their infrastructure, ensuring consistency and minimising risks associated with configuration drift or misconfiguration.

APRA requirement

How HashiCorp helps

Information security controls implemented at all stages

34

Information security controls implemented at all stages

HashiCorp implements security controls at all stages of infrastructure lifecycle management. Terraform uses infrastructure as code workflows, which offer a system of record for managed resources as well as the ability to manage the entire infrastructure lifecycle. HashiCorp security lifecycle management uses identity-based security workflows, and offers a system of record for sensitive information (credentials, certificates, keys, customer data) as well as the ability to manage the entire lifecycle of sensitive information.

Vulnerabilities and threats are identified, assessed and remediated

39

Vulnerabilities and threats are identified, assessed and remediated:

(c) develop tactical and strategic remediation activities for the control environment (prevention, detection and response) commensurate with the threat; and

(d) implement mechanisms to disrupt the various phases of an attack. Example phases include reconnaissance, vulnerability exploitation, malware installation, privilege escalation, and unauthorised access.

(c) Sentinel provides policy as code framework, enabling the enforcement of compliance and governance rules, which helps in the early detection of non-compliant resources. HashiCorp’s products also support automated workflows for responding to security incidents, reducing the time between detection and remediation.

(d) With The Infrastructure Cloud from HashiCorp, organisations can create a robust defence against cyber threats, disrupting attackers at each stage of their campaign, including:

1. HashiCorp helps prevent reconnaissance through Consul’s service discovery and mesh capabilities, which can obscure the details of the infrastructure from potential attackers, making reconnaissance more difficult.
2. Vault manages secrets and protects sensitive data, reducing the risk of credential theft and subsequent exploitation of vulnerabilities.
3. HashiCorp’s policy as code framework, Sentinel, can enforce policies that prevent unauthorised software installations, thereby mitigating the risk of malware being installed.
4. Vault provides identity-based access, enabling fine-grained control over who has access to specific infrastructure, thus preventing unauthorised privilege escalation.

End-of-life and out-of-support issues

40, 41, 42, 43

End-of-life and out-of-support issues

Terraform tracks the creation and modification times of resources which can be used to infer the age of IT assets such as applications in the cloud. Terraform can also shutdown cloud workloads based on a predefined time to live or lack of activity, thereby reducing the attack surface.

Packer can codify the security hardening and compliance of machine images prior to deployment to prevent the deployment of incorrect versions, update non-compliant images, and/or isolate non-compliant images. EOL/EOS in machine images including operating systems can be identified at scale across any cloud, and the system either hot-fixed, patched or decommissioned. Packer does not replace configuration management like Chef or Puppet. In fact, when building images, Packer is able to use tools like Chef or Puppet to install software onto the image.

Minimise exposure to plausible worst case scenarios

44, 45

Minimise exposure to plausible worst case scenarios, such as

a) malicious acts by an insider with highly-privileged access, potentially involving collusion with internal or external parties;

b) deletion or corruption of both production and backup data, either through malicious intent, user error or system malfunction; and

c) loss of, or unauthorised access to, encryption keys safeguarding extremely critical or sensitive information assets.

1. HashiCorp’s approach to privileged access management emphasises the principle of least privilege and the need for robust identity verification and access controls to prevent unauthorised actions by insiders. HashiCorp’s identity based access products, Boundary and Vault, enable security administrators to define identity-based policies as code with short-lived credentials to manage access to modern, dynamic systems ensuring privileges are tightly controlled and access is granted based on verified identities, reducing the risk of insider threats.

Cryptography and key management protecting Vault secrets are designed to stand up to attacks from skilled adversaries, including insider threats. Vault’s cryptographic barrier and unsealing process protect data at rest.  This ensures that even if an insider has access to the storage backend, they cannot access Vault’s secrets without the proper unsealing process.

1. HashiCorp products provide fine-grained access control policies which can enforce restrictions on who can access what data, contributing to data loss prevention. 

HashiCorp products also support multi-serve mode for high availability and replication for redundancy, helping avoid risks associated with an attack on the secrets engine. Vault employs robust access controls that can limit who has the ability to delete the Vault cluster or its data.

1. [see next section]

44, 45

Minimise exposure to plausible worst case scenarios, such as

a) malicious acts by an insider with highly-privileged access, potentially involving collusion with internal or external parties;

b) deletion or corruption of both production and backup data, either through malicious intent, user error or system malfunction; and

c) loss of, or unauthorised access to, encryption keys safeguarding extremely critical or sensitive information assets.

c. HashiCorp helps ensure encryption keys are protected against unauthorised access and loss with:

Encryption: Vault encrypts all data, including encryption keys, using 256-bit AES in GCM mode with a randomly generated nonce. This ensures that the storage backend never sees the unencrypted value.

Key Rotation: Vault supports automatic key rotation, which allows encryption keys to be updated and rotated without code changes or redeployment.

Access Control: Vault uses fine-grained access control policies to restrict who can access encryption keys. Only authorised users or systems with the correct permissions can access the keys.

Unseal process: The unseal process in Vault is designed to protect against unauthorised access. The unseal process in Vault is designed to protect against unauthorised access. By default, Vault uses Shamir’s secret sharing algorithm to split the master key into multiple shares, requiring a subset of these shares to reconstruct the master key and access the encryption keys.

Barrier Seal: Vault’s security barrier automatically encrypts all data leaving Vault, including encryption keys, using a 256-bit AES cipher in GCM mode with 96-bit nonces, which are randomly generated for every encrypted object.

Security in change management

47

Security in change management - APRA envisages that a regulated entity would implement controls to manage changes to information assets, including changes to hardware, software, data, and configuration

HashiCorp supports security in change management through a variety of tools and practices that ensure changes to hardware, software, data, and configurations are managed securely. Terraform allows for the provisioning and management of infrastructure using code, which helps in maintaining consistency, traceability, and version control of infrastructure changes. All information about changes are logged (and can be streamed to observability systems). Changes recorded on the audit log can be categorised based on risk.

An important factor in change management is handling changes at scale. HashiCorp tools are designed for deploying a single application or managing thousands of services across multiple clouds.

Software security

48

An APRA-regulated entity would typically implement secure software development and acquisition techniques to assist in maintaining confidentiality, integrity and availability by improving the general quality and vulnerability profile of the software

Sentinel codifies compliance policies and enforces them across infrastructure and applications. By integrating Sentinel policies into CI/CD pipelines, code changes can be automatically evaluated against compliance requirements and prevent non-compliant deployments.

Data leakage

50, 51, 52, 53

50 Data leakage is the unauthorised removal, copying, distribution, capturing or other types of disclosure of sensitive data that results in a loss of data confidentiality (also known as a data breach). Access to data removal methods would typically be subject to risk assessment and only granted where a valid business need exists.

53 Wholesale access to sensitive data (e.g. contents of customer databases or intellectual property that can be exploited for personal gain) would be highly restricted to reduce the risk exposure to significant data leakage events. Industry experience of actual data leakage incidents include the unauthorised extraction of debit/credit card details, theft of personally identifiable information, loss of unencrypted backup media and the sale/trade or exploitation of customer identity data.

Vault provides robust access control mechanisms, including fine-grained policies and role-based access control (RBAC), to restrict access to PCI DSS data based on user roles and permissions. Additionally, Vault integrates with identity providers and authentication systems, enabling centralised authentication and single sign-on (SSO) for accessing sensitive data.

Vault offers encryption as a service, to encrypt data at rest and in transit using industry-standard algorithms and protocols. By encrypting PCI DSS data throughout its lifecycle, data including PII/PCI, can be protected from unauthorised access and ensure compliance with encryption requirements.

Vault offers comprehensive auditing capabilities, to track and monitor access to PCI DSS data in real-time. Vault logs all access requests, including who accessed the data, when, and from where, providing an audit trail for compliance purposes and security investigations.

Consul provides service mesh capabilities for securing communication between microservices and distributed applications. By encrypting traffic with mutual TLS (mTLS) and enforcing access control policies, Consul helps protect PCI DSS data as it traverses the network, preventing eavesdropping and tampering attacks.

Cryptographic techniques to restrict access

54, 55

54 Cryptographic techniques can be used to control access to sensitive data, both in storage and in transit. The strength of the cryptographic techniques deployed would be commensurate with the sensitivity and criticality of the data as well as other supplementary or compensating controls (...).

55 In order to minimise the risk of compromise, an end-to-end approach would typically be adopted, where encryption is applied from the point-of-entry to final destination.

Vault categorises sensitive data based on its criticality or sensitivity using metadata or custom attributes. Policies and access controls can be defined for different categories of data, ensuring that more critical or sensitive data is protected with stronger encryption, stricter access controls, and more rigorous auditing.

Vault enables the encryption of sensitive data at rest using industry-standard cryptographic algorithms, such as AES (Advanced Encryption Standard). When data is stored in Vault, it is encrypted using a master encryption key, ensuring that even if the underlying storage is compromised, the data remains unreadable.

Vault encrypts data in transit. Vault's transit secrets engine provides a secure platform for encrypting and decrypting data in transit. Applications can leverage the transit secrets engine to encrypt sensitive data before transmitting it to other systems or users. Vault manages the encryption keys and performs cryptographic operations transparently, ensuring that data remains protected throughout its journey.

Vault can act as a Certificate Authority (CA) or integrate with existing CAs to issue and manage TLS certificates for secure communication between applications and users. By leveraging Vault as a CA, organisations can centralise certificate management, automate certificate issuance and renewal, and enforce security policies for TLS encryption.

Information security technology solutions

56

An APRA-regulated entity would typically deploy appropriate information security technology solutions which maintain the security of information assets. Examples include firewalls, network access control, intrusion detection/prevention devices, anti-malware, encryption and monitoring/log analysis tools. The degree of reliance placed on technology solutions for information security could necessitate a heightened set of lifecycle controls…

Consul primarily focuses on service networking and service mesh capabilities for securing communication between microservices and distributed applications.

Consul can be used to dynamically configure firewall rules and network access control lists (ACLs) based on service discovery and metadata provided by Consul, through Consul’s integration with firewall management tools or network infrastructure devices.

Consul can facilitate integration with intrusion detection/prevention systems (IDPS) by providing service discovery and health checking capabilities, detect anomalies in service behaviour, and respond to security threats in real-time.

Consul integrates with anti-malware solutions deployed within the network infrastructure or at the endpoint level, enabling automated deployment and updates of anti-malware agents or configurations based on service lifecycle events.

Consul supports encryption of communication between services using mutual TLS (mTLS) encryption. By enabling mTLS in Consul, organisations can encrypt traffic between services, authenticate service identities, and prevent unauthorised access or eavesdropping attacks.

Consul integrates with monitoring and log analysis tools to provide visibility into service health, performance metrics, and operational logs, and can feed this information into other observability tools.

End-user developed/configured software

57, 58, 59

57. Current technologies allow end-users to develop/configure software for the purpose of automating day-to-day business processes or facilitating decision-making (e.g. spreadsheets, local databases, user administered software). This creates the risk that life-cycle controls could be inadequate for critical information assets and possibly lead to a proliferation of sensitive data being accessible outside controlled environments.

58. An APRA-regulated entity would typically introduce processes to identify and classify end-user developed/configured software and assess risk exposures. In APRA’s view, any information software asset that is critical to achieving the objectives of the business or

that processes sensitive data would comply with the relevant life-cycle management controls of the regulated entity.

59. Sound practice is to establish a formal policy to govern end-user developed/configured software. The policy would clearly articulate under what circumstances end-user developed/configured software is appropriate, as well as expectations regarding lifecycle management controls including information security, development, change management and backup.

HashiCorp can codify the organisational policy to govern the infrastructure and security lifecycle management of all end-user developed and configured software. The codified policies can ensure sensitive data is contained within the appropriate environment, and is encrypted or tokenized. Policy as code can prevent PII/PCI data being moved to locations outside of policy and create alerts of any attempts.

Emerging technologies

60, 61, 62

New technologies potentially introduce a set of additional information security vulnerabilities, both known and unknown. An APRA-regulated entity would typically apply appropriate caution when considering the introduction of new technologies.

Typically, an APRA-regulated entity would only authorise the use of new technologies in a production environment where the technology:

a) has matured to a state where there is a generally agreed set of industry-accepted controls to manage the security of the technology; or

b) compensating controls are sufficient to reduce residual risk within the entity’s risk appetite.

An APRA-regulated entity could find it useful to develop a technology authorisation process and maintain an ‘approved technology register’ to facilitate this. The authorisation process would typically assess the benefits of the new technology against

the impact of an information security compromise, including an allowance for uncertainty.

Standardising on HashiCorp for cloud infrastructure provides organisations with a unified platform for managing infrastructure, applications, and security across hybrid and multi-cloud environments. This simplifies the introduction of new technologies including cloud service providers and cloud based software, as well as new technology systems integrators and managed service providers.

By adopting consistent workflows, embracing infrastructure as code principles, leveraging modularity and extensibility, enforcing policy as code, promoting collaboration and knowledge sharing, and investing in training and support, organisations can effectively manage the use of new technologies while ensuring consistent security, compliance, and operational efficiency.

Information assets managed by third parties and related parties

63, 64, 65

Information assets managed by third parties and related parties

Refer to HashiCorp CPS 230 guidance, Management of Service Providers.

Detection of security compromises

66, 67, 68, 69,

Detection of security compromises

Common monitoring techniques include:

a) network and user profiling that establishes a baseline of normal activity which, when combined with logging and alerting mechanisms, can enable detection of anomalous activity;

b) scanning for unauthorised hardware, software and changes to configurations;

c) sensors that provide an alert when a measure breaches a defined threshold(s) (e.g. device, server and network activity);

d) logging and alerting of access to sensitive data or unsuccessful logon attempts to identify potential unauthorised access; and

e) users with privileged access accounts subject to a greater level of monitoring in light of the heightened risks involved.

Refer to HashiCorp CPS 230 guidance, Management of Service Providers.

1. HashiCorp facilitates the detection of anomalous behaviour in infrastructure and security workflows, and logs and streams these events to external auditing and/or observability tools.
2. Terraform identifies any discrepancies or "drift" between an authorised configuration and a deployed configuration, highlighting changes made outside of Terraform's management. This helps maintain infrastructure consistency and facilitates remediation of unauthorised modifications.
3. HashiCorp products integrate with monitoring and alerting systems to provide alerts when there's any deviation from a defined configuration. As well as the above drift detection, Vault integrates with logging and monitoring tools to detect unauthorised access or configuration changes, issuing alerts for security breaches or policy violations.
4. As per c) above
5. Super users can be granted access only to the resources and capabilities necessary for their responsibilities, reducing the risk of unauthorised access. Integration with Security Information and Event Management (SIEM) systems and monitoring tools can aggregate and analyse audit logs, generate alerts, and provide real-time visibility into super user activity. Administrators can configure alerts for specific events or anomalies, enabling proactive detection and response to security incidents involving privileged access accounts.

Systematic testing program

78

“...an APRA-regulated entity would… maintain a program of testing which validates the design and operating effectiveness of controls over time.

As previously discussed, HashiCorp products offer test and reporting functionality that will include all test results as well as deficiencies. A significant benefit of HashiCorp’s approach to multi-cloud environments is a significant reduction in the number of tests and controls through standardisation, as well as the reduction of attack surface through controls such as graceful temporary or permanent shutdown of sunset cloud environments. Terraform's licensed editions in particular offer AI Generated tests for infrastructure as code allowing organisations to embed test cases rapidly.