Skip to main content
kics Run Checkmarx KICS for Infrastructure as Code security scanning. Use when analyzing Terraform, CloudFormation, Kubernetes, Ansible, Dockerfile, or other IaC for misconfigurations and security issues.
Zur Installation springen Skills Marktplatz Entdecken und erkunden Sie KI-Skills, die von der Community erstellt wurden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Prompt-Details anzeigen Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
npx skills add https://github.com/igbuend/grimbard --skill kicsDer Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.
Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.
ZIP herunterladen Herunterladen... SOC
Basierend auf der SOC-Berufsklassifikation
Mehr aus diesem Repository
name kics description Run Checkmarx KICS for Infrastructure as Code security scanning. Use when analyzing Terraform, CloudFormation, Kubernetes, Ansible, Dockerfile, or other IaC for misconfigurations and security issues. allowed-tools ["Bash","Read","Glob","Grep"]
Checkmarx KICS (Keeping Infrastructure as Code Secure)
When to Use KICS
Ideal scenarios:
Infrastructure as Code (IaC) security scanning
Cloud configuration analysis (AWS, Azure, GCP, Oracle)
Kubernetes manifest security review
Dockerfile security hardening
Terraform/OpenTofu security assessment
Ansible playbook security validation
CI/CD pipeline IaC security gates
Compliance checking (CIS, PCI-DSS, NIST, SOC2)
Complements other tools:
Use alongside application security scanners (Semgrep, CodeQL)
Combine with SARIF Issue Reporter for detailed findings
Use with cloud posture management tools
When NOT to Use
Do NOT use this skill for:
Application source code vulnerability scanning (use Semgrep or CodeQL)
Secrets detection (use Gitleaks)
Dependency vulnerability scanning (use OSV-Scanner or Depscan)
Runtime cloud posture assessment (use CSPM tools)
Binary or compiled code analysis
Installation
wget https://github.com/Checkmarx/kics/releases/latest/download/kics_linux_amd64.tar.gz
tar -xzf kics_linux_amd64.tar.gz
sudo
mv
sudo
mv
Core Workflow
1. Quick Scan
kics scan -p .
kics scan -p /path/to/iac
kics scan -p . --silent
kics scan -p . --no-color
2. SARIF Output
kics scan -p /path/to/iac \
--report-formats sarif \
--output-path results.sarif
kics scan -p /path/to/iac \
--report-formats json,sarif \
--output-path .
kics scan -p /path/to/iac \
--report-formats sarif \
--output-name kics-results
kics scan -p /path/to/iac \
--report-formats all \
--output-path ./reports
3. Platform-Specific Scans
kics scan -p ./cloudformation --type CloudFormation
kics scan -p ./terraform --type Terraform
kics scan -p ./k8s --type Kubernetes
kics scan -p ./docker --type Dockerfile
kics scan -p ./ansible --type Ansible
kics scan -p ./arm --type AzureResourceManager
kics scan -p ./gdm --type GoogleDeploymentManager
kics scan -p ./charts --type Helm
4. Severity Filtering
kics scan -p . --minimal-ui --fail-on high,critical
kics scan -p . --exclude-severities info
kics scan -p . \
--fail-on high,critical \
--report-formats sarif \
--output-path results.sarif
Configuration
Config File Create .kics.yml or kics.config:
path: ./infrastructure
exclude-queries:
- 487f4be7-3fd9-4506-a07a-96c39d0b30ad
fail-on:
- high
- critical
output-path: ./kics-results
report-formats:
- sarif
- json
- html
exclude-paths:
- "./tests/**"
- "./examples/**"
- "**/.terraform/**"
exclude-results:
- abc123def456
type:
- Terraform
- Kubernetes
- Dockerfile
ci: true
no-color: true
minimal-ui: true
kics scan --config .kics.yml
Inline Suppressions # Terraform - suppress specific finding
resource "aws_s3_bucket" "example" {
# kics-scan ignore-line
bucket = "my-bucket"
acl = "public-read" # Suppressed above
}
# Suppress entire block
# kics-scan ignore-block
resource "aws_security_group" "example" {
ingress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
apiVersion: v1
kind: Pod
metadata:
name: example
spec:
hostNetwork: true
containers:
- name: app
image: nginx:latest
CI/CD Integration (GitHub Actions) name: KICS IaC Scan
on:
push:
branches: [main ]
paths:
- '**.tf'
- '**.yaml'
- '**.yml'
- 'Dockerfile*'
pull_request:
paths:
- '**.tf'
- '**.yaml'
- '**.yml'
- 'Dockerfile*'
jobs:
kics:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run KICS
uses: checkmarx/kics-github-action@v2.1.1
with:
path: .
output_path: kics-results
output_formats: 'sarif,json,html'
fail_on: high,critical
enable_comments: true
exclude_paths: 'tests/**,examples/**'
- name: Upload SARIF
if: always()
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: kics-results/results.sarif
category: kics
- name: Upload Results
if: always()
uses: actions/upload-artifact@v4
with:
name: kics-results
path: kics-results/
Common Use Cases
1. Terraform Security Audit
kics scan -p ./terraform \
--type Terraform \
--report-formats sarif,html \
--output-path ./security-audit \
--fail-on high,critical
open ./security-audit/results.html
sarif summary ./security-audit/results.sarif
2. Kubernetes Hardening
kics scan -p ./k8s \
--type Kubernetes \
--report-formats sarif \
--output-name k8s-security
kics scan -p ./k8s \
--type Kubernetes \
--fail-on high,critical \
--exclude-severities low,medium,info
3. Multi-Cloud Infrastructure
kics scan -p ./infrastructure \
--type Terraform,CloudFormation,AzureResourceManager \
--report-formats sarif,json \
--output-path ./reports
4. Dockerfile Security
kics scan -p . \
--type Dockerfile \
--report-formats sarif \
--output-name dockerfile-scan
kics scan -p . \
--type Dockerfile,DockerCompose \
--report-formats sarif
Understanding Output
SARIF Structure KICS SARIF v2.1.0 includes:
Rules : Each query/check (1500+ built-in queries)Results : Specific IaC misconfigurations foundProperties :
Severity: HIGH, MEDIUM, LOW, INFO
Category: Security, Best Practices, etc.
Platform: Terraform, K8s, Dockerfile, etc.
CWE mapping
Remediation guidance
Result Categories Category Examples Access Control Overly permissive IAM, public resources Encryption Unencrypted storage, weak TLS Networking Open security groups, exposed ports Secret Management Hardcoded credentials, exposed secrets Resource Configuration Missing logging, backup disabled Best Practices Missing tags, resource limits Insecure Defaults Default passwords, debug mode
Advanced Features
Custom Queries Create custom query in custom-queries/:
# custom-queries/require_tags.rego
package Cx
CxPolicy[result] {
resource := input.document[i].resource.aws_instance[name]
not resource.tags
result := {
"documentId": input.document[i].id,
"searchKey": sprintf("aws_instance[%s]", [name]),
"issueType": "MissingAttribute",
"keyExpectedValue": "Tags should be defined",
"keyActualValue": "Tags are not defined"
}
}
kics scan -p ./terraform \
--queries-path ./custom-queries \
--report-formats sarif
Query Information
kics list-platforms
kics show-query <query-id>
kics generate-documentation
Results Management
kics scan -p . --report-formats json -o baseline.json
kics scan -p . --exclude-results $(cat baseline.json | jq -r '.results[].similarity_id' )
Compliance Frameworks
CIS Benchmarks : AWS, Azure, GCP, KubernetesPCI-DSS : Payment card industry standardsHIPAA : Healthcare complianceGDPR : Data protection requirementsSOC 2 : Security controlsNIST : Cybersecurity framework
kics scan -p . --include-queries "CIS*" --report-formats sarif
Performance Optimization
kics scan -p . --parallel 8
kics scan -p . --file-size-limit 1000
kics scan -p . --exclude-paths "**/node_modules/**,**/.terraform/**"
kics scan -p . --minimal-ui --silent --no-progress
Limitations
Runtime issues : Can't detect runtime misconfigurationsCustom modules : Limited visibility into external Terraform modulesContext awareness : May flag acceptable exceptionsFalse positives : Generic rules may not fit all use casesRemediation : Provides guidance but doesn't auto-fix
Rationalizations to Reject Shortcut Why It's Wrong "KICS found nothing = IaC is secure" KICS has 1500+ queries but can't cover every misconfiguration "Suppress all LOW/MEDIUM findings" Lower severity findings can combine to create critical risks "Skip IaC scanning in CI" IaC defines infrastructure; security issues here affect entire environment "Only scan before deployment" Early detection in development prevents costly late-stage fixes "Ignore platform-specific queries" Platform-specific checks catch cloud provider misconfigurations
References 