IaC & misconfiguration scanning
In plain terms#
Modern infrastructure is defined in files: Terraform for cloud resources, Kubernetes manifests for workloads, Dockerfiles for images, Helm charts, CloudFormation. Infrastructure-as-Code (IaC) scanning, also called misconfiguration scanning, checks those files for insecure settings before they're applied to a real environment.
The most damaging cloud incidents are rarely exotic exploits; they're misconfigurations, a storage bucket left public, a security group open to the world, a container running as root.
Why it matters#
An IaC misconfiguration is a production incident waiting for terraform apply. Because the
insecurity lives in a text file, it can be caught in code review, turning "we found an open database
in prod" into "we blocked a pull request." This is one of the highest-leverage places to shift
security left.
Where it fits#
- Artifact: IaC definitions in your repo,
*.tf, Kubernetes YAML,Dockerfile, Helm, etc. - Stage: on the pull request that changes infrastructure, before it's provisioned.
How it works#
A scanner parses each IaC file into a structured model and evaluates it against a library of
policies ("no public S3 buckets," "pods must set runAsNonRoot," "no :latest image tags").
Many tools let you write custom policies (often in Rego, the language of the
Open Policy Agent (OPA))
to encode your own organization's rules.
Popular & reputable tools#
| Tool | Notes |
|---|---|
| Trivy (config/misconfig) | OSS; scans Terraform, K8s, Dockerfile, Helm |
| Checkov | OSS, from Bridgecrew/Prisma; large built-in policy set |
| tfsec | OSS, Terraform-focused (now folded into Trivy) |
| KICS | OSS, from Checkmarx; broad IaC coverage |
| kube-bench | OSS; CIS benchmarks for live clusters (see posture) |
Manifests are not the cluster#
Scanning the manifests is not the same as checking the cluster. IaC scanning reads what you declared; a cluster drifts from that the first time someone changes a setting during an incident, and it was never covered for anything applied before the manifests existed.
The complementary check is a posture scan against the running system. The CIS Kubernetes Benchmark is the usual baseline, covering RBAC, service accounts, Pod Security Standards and network policies as they are.
Common pitfalls#
- Defaults are noisy. Out-of-the-box policy packs flag many low-impact issues; tune to what matters for your environment.
- Scanning files ≠ scanning reality. IaC scanning catches what's declared; drift (manual changes in the console) needs runtime posture checks too.
- Custom policy is where the value is. The generic rules are table stakes; encoding your own guardrails is what prevents your recurring mistakes.
iac control runs Trivy's misconfiguration scanner over a component's repository (Terraform, Kubernetes, Dockerfiles, and more), normalized to SARIF alongside your other controls. See quickstart in the docs.
Keep learning#
- Container image scanning, the image the Dockerfile builds
- Infrastructure & CIS benchmarks. Checking live posture, not just files