Infrastructure-as-code templates

Name: Infrastructure-as-code templates
Creator: TestPattern Community
License: https://opensource.org/licenses/MIT

Identifies infrastructure-as-code files (Terraform, CloudFormation, ARM/Bicep, Ansible) with populated resource, provider, task or network definitions. IaC wording alone is discovery-only.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: topic wording is discovery-only; enforcement requires IaC structure, and 85 adds a second structure and cloud security context.
Detection quality: Topic verified
Jurisdictions: global
Regulations: Criminal Code Act 1995 (Cth)
Frameworks: ISO 27001, NIST CSF, CIS Controls
Data categories: security, technology
Scope: wide
Risk rating: 7
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:infrastructure[\s-]as[\s-]code|IaC\s+(?:templates?|modules?|repository|repo|code)|ARM\s+templates?|Bicep\s+(?:templates?|modules?|files?)|Terraform\s+(?:configuration|modules?|plan|state|code|files?)|CloudFormation\s+(?:templates?|stacks?)|Ansible\s+playbooks?|Pulumi\s+(?:program|stack)|main\.tf|terraform\.tfvars)\b

Corroborative evidence keywords

production, VPC, subnet, security group, IAM role, key vault

Proximity: 300 characters

Should match

Terraform module for the payments network (main.tf) # Production VPC security group for the payments database provider "aws" { region = "ap-southeast-2" } resource "aws_security_group" "payments_db" { name = "payments-db-prod" ingress { from_port = 5432 to_port = 5432 protocol = "tcp" cidr_blocks = ["10.20.0.0/16"] } } — High tier (85) - Terraform provider/resource blocks and CIDR ingress with production VPC security group context
Ansible playbook for patching web servers: - hosts: webservers become: true tasks: - ansible.builtin.yum: name: httpd state: latest — Medium tier (75) - Ansible task structure only
CloudFormation stack for the records bucket: AWSTemplateFormatVersion: '2010-09-09' Resources: RecordsBucket: Type: AWS::S3::Bucket — Medium tier (75) - CloudFormation resource type only
We are moving the remaining servers to infrastructure as code next year. — Discovery tier (65) - topic wording only

Should not match

unrelated generic text without domain phrases — No relevant topic phrases present
Guidance note: organisations should scan infrastructure as code for open security groups before merging. — Guidance text
CloudFormation blank template skeleton AWSTemplateFormatVersion: ________ Resources: ________ — Blank template
Training module: learners write a Terraform module with resource "aws_s3_bucket" "demo" in a sandbox account. — Training/demo framing must not enforce

Known false positives

Provider documentation, IaC tutorials and module registries contain resource blocks and CIDR examples. Mitigation: Topic wording is discovery-only; enforcement needs IaC structure, and guidance/tutorial/demo/template framing is excluded.
Genuine files described as an "ARM template" or "CloudFormation template" trip the shared template-exclusion NOT group (false negative). Mitigation: Documented limitation; Terraform, Bicep and Ansible content and CloudFormation bodies (AWSTemplateFormatVersion) are unaffected.