iac-scan

# Vulnetix IaC Scan Skill ## Use when - Pre-apply: scan `*.tf` / `*.tofu` for misconfigurations. - PR review: catch open security groups, plaintext secrets, IAM wildcards. - Audit existing infra against compliance baselines (CIS, NIST). - Detect drift between repo IaC and deployed state. - Pre-merge: gate on critical findings (e.g. publicly-readable S3). ## Don't use for - Source-code SAST — use `sast-scan`. - Dockerfile / container analysis — use `container-scan`. - Cloud runtime monitoring — Pix is static-only; use a CSPM for runtime. ## Conventions Follows `skills/_lib/contract.md`. In short: use the `vulnetix_*` MCP tools when the agent has them and the CLI otherwise — both shape their own output, so there is no jq step any more. Independent calls go out as concurrent Bash tool calls in one message. One trailing suggestion, not a playbook. See the contract for surface selection, output style and memory writes. ## Step 1: Load capabilities Read `.vulnetix/capabilities.yaml`. Confirm `derived.has_iac: true` or `--paths` provided. Otherwise abort. ## Step 2: Run scan ```bash vulnetix iac --paths "$PATHS" -o json > .vulnetix/iac.${TIMESTAMP}.json ``` Captures: open security groups, missing encryption, public S3/GCS, IAM wildcards, unpinned providers, secrets in plaintext, missing tags, unencrypted state backends. ## Step 3: Render | Severity | File:Line | Resource | Issue | Recommendation | Group by file. For each high-severity issue, include a 2-3 line code example of the fix. ## Step 4: Risk overlay If `binaries.terraform: true` (or `tofu`), suggest: ```bash terraform plan -no-color | head -200 # for context on what would change ``` Don't run `terraform apply` from the skill. ## Memory update `.vulnetix/iac/<timestamp>.summary.yaml` with finding counts. ## Edge cases & gotchas - Requires `derived.has_iac: true` OR explicit `--paths`. CWD without `*.tf` files = empty result. - Detection is static — it cannot evaluate runtime variable interpolation. `var.environment == "prod"` conditional logic is reported as both branches. - `terraform plan` integration is suggestive only — the skill does NOT run `terraform plan` automatically (state access concerns). - Provider-specific rules (AWS / GCP / Azure) are detected via resource type prefixes; modules wrapping resources may obscure the type. - Pre-existing infra not present in IaC (`terraform import` candidates) is not detected. - k8s manifest support is limited to top-level YAML in `*.yaml` files with kind: matching common workload types.