implementing-infrastructure-as-code-security-scanning

name	implementing-infrastructure-as-code-security-scanning
description	This skill covers implementing automated security scanning for Infrastructure as Code (IaC) templates using tools like Checkov, tfsec, and KICS. It addresses detecting misconfigurations in Terraform, CloudFormation, Kubernetes manifests, and Helm charts before deployment, establishing policy-based governance, and integrating IaC scanning into CI/CD pipelines to prevent insecure cloud resource provisioning.
domain	cybersecurity
subdomain	devsecops
tags	["devsecops","cicd","iac-security","checkov","tfsec","terraform","secure-sdlc"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04"]

Implementing Infrastructure as Code Security Scanning

When to Use

• When provisioning cloud infrastructure with Terraform, CloudFormation, or Pulumi and needing automated security validation
• When compliance frameworks require evidence of infrastructure configuration review before deployment
• When preventing common cloud misconfigurations like public S3 buckets, open security groups, or unencrypted storage
• When establishing guardrails that block insecure infrastructure changes in pull requests
• When managing multi-cloud environments requiring consistent security policies across AWS, Azure, and GCP

Do not use for scanning application source code (use SAST), for monitoring already-deployed infrastructure drift (use cloud security posture management tools), or for container image vulnerability scanning (use Trivy).

Prerequisites

• Checkov v3.x installed (pip install checkov) or tfsec installed
• Terraform, CloudFormation, or Kubernetes IaC files in the repository
• CI/CD pipeline with access to IaC directories
• Bridgecrew API key (optional, for Checkov platform integration)

Workflow

Step 1: Run Checkov Against Terraform Files

# Scan all Terraform files in a directory
checkov -d ./terraform/ --framework terraform --output cli --output json --output-file-path ./results

# Scan specific file
checkov -f main.tf --output json

# Scan Terraform plan (more accurate for dynamic values)
terraform init && terraform plan -out=tfplan
terraform show -json tfplan > tfplan.json
checkov -f tfplan.json --framework terraform_plan

# Scan with specific checks only
checkov -d ./terraform/ --check CKV_AWS_18,CKV_AWS_19,CKV_AWS_20

# Skip specific checks
checkov -d ./terraform/ --skip-check CKV_AWS_145,CKV2_AWS_6

Step 2: Integrate IaC Scanning into GitHub Actions

# .github/workflows/iac-security.yml
name: IaC Security Scan

on:
  pull_request:
    paths:
      - 'terraform/**'
      - 'cloudformation/**'