| name | implementing-infrastructure-as-code-security-scanning |
| description | This skill covers implementing automated security scanning for Infrastructure as Code (IaC) templates using tools like Checkov, tfsec, and KICS. It addresses detecting misconfigurations in Terraform, CloudFormation, Kubernetes manifests, and Helm charts before deployment, establishing policy-based governance, and integrating IaC scanning into CI/CD pipelines to prevent insecure cloud resource provisioning.
|
| domain | cybersecurity |
| subdomain | devsecops |
| tags | ["devsecops","cicd","iac-security","checkov","tfsec","terraform","secure-sdlc"] |
| version | 1.0.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04"] |
Implementing Infrastructure as Code Security Scanning
When to Use
- When provisioning cloud infrastructure with Terraform, CloudFormation, or Pulumi and needing automated security validation
- When compliance frameworks require evidence of infrastructure configuration review before deployment
- When preventing common cloud misconfigurations like public S3 buckets, open security groups, or unencrypted storage
- When establishing guardrails that block insecure infrastructure changes in pull requests
- When managing multi-cloud environments requiring consistent security policies across AWS, Azure, and GCP
Do not use for scanning application source code (use SAST), for monitoring already-deployed infrastructure drift (use cloud security posture management tools), or for container image vulnerability scanning (use Trivy).
Common Misconfigurations & Verification
An IaC scan that never fails the build provisions insecure infrastructure anyway:
soft_fail: true / --soft-fail. Checkov and tfsec exit 0 in soft-fail mode, so the PR merges with HIGH findings. Set soft_fail: false on the gating job.- Scanning
.tf source instead of the plan. Static .tf scanning misses computed values and module expansions; downloaded/registry modules under .terraform/modules/ are skipped unless you terraform init and scan the terraform_plan JSON (terraform show -json tfplan > tfplan.json; checkov -f tfplan.json --framework terraform_plan).
- Over-broad suppressions. A long
skip-check: list or blanket # checkov:skip= comments quietly disable real controls (e.g. skipping CKV_AWS_18/CKV_AWS_20) — audit them.
- Graph checks not running. Relationship checks (the
CKV2_ prefix) require graph mode; resource-level-only scans miss "bucket exists but no public_access_block" cases.
- SARIF uploaded but no gate. Uploading to the Security tab with
if: always() while the job is allowed to pass is reporting, not gating.
Concrete verification: Add a Terraform resource that is plainly insecure (a public-read aws_s3_bucket ACL with no aws_s3_bucket_public_access_block, or an allowing on port 22) and open a PR. Confirm Checkov/tfsec (CKV_AWS_18/CKV_AWS_24 fire), then confirm a hardened version passes.
