IaC (Infrastructure Code)
When you define infrastructure as code, a single misconfiguration gets deployed and repeated as-is. IaC analysis checks the security misconfigurations of the infrastructure code (Infrastructure as Code) included in your repository before deployment. It targets the infrastructure definition files of the Source Code service.
Supported targets (IaC frameworks)
Infrastructure-as-Code scanning supports the following frameworks / formats.
- Terraform · Terraform Plan · AWS CloudFormation · AWS CDK
- Kubernetes · Helm · Kustomize
- Dockerfile · Serverless Framework
- ARM · Bicep (Azure)
- CI pipelines: GitHub Actions · GitLab CI · Bitbucket Pipelines · Azure Pipelines
- Argo Workflows · Ansible · OpenAPI
Problems it finds
- Overly open networks / security groups
- Missing encryption (at rest / in transit)
- Privileged containers, running as root, missing resource limits
- Hardcoded credentials, insecure defaults
Handling results
- If a setting is intended per organization policy, mark it as accepted risk.
- Exceptions to a tool rule can be suppressed as false positives.
- IaC results are also mapped to Compliance standards.
Difference from Infrastructure Checks
IaC analysis looks at the code (definition files). The configuration of clusters / nodes actually in operation is checked in Infrastructure Checks (K8s / CIS / hardening). The code may pass while the operational state has drifted, so the two are complementary.