infrastructure-as-codeInfrastructure as Code
Keep cloud topology reproducible, reviewable, and drift-aware.
Production domain 06
Cloud Infrastructure & Compute
3 capabilities and 3 controls define the canonical obligation set for this domain.
Applicability and claim boundary
This domain defines obligations. It does not prove that a specific repository or run satisfies them.
- Applicability
- Assess this domain when the authorized workload can affect its capabilities. Resolve every control as required, potentially affected, or not applicable before completion.
- Proof level
- The accepted formats below identify possible evidence inputs. A format alone does not establish semantic or authoritative assurance; provenance and the commissioned proof contract set the supported level.
- Claim boundary
- Static controls are requirements, not execution evidence, provider attestation, or proof of production readiness.
Capabilities
cloud-boundariesCloud Boundaries
Apply least privilege across IAM, network, region, and secret boundaries.
cloud-cost-governanceCloud Cost Governance
Make ownership, budgets, forecasts, and anomaly limits explicit.
Controls
CLOUD-IAC-001Infrastructure as CodeCloud topology is reviewable, reproducible, and drift-detected.
Accepted evidence format: Artifact, Provider reportCLOUD-BOUNDARY-001Cloud BoundariesIAM, network, region, and secret boundaries are least-privilege.
Accepted evidence format: Artifact, Provider reportCLOUD-COST-001Cloud Cost GovernanceOwnership, budgets, forecasts, and anomaly thresholds are explicit.
Accepted evidence format: Metric