Infrastructure-as-Code Scanning

Path: /code/iac · Sidebar: Testing → Code Security → IaC

IaC scanning checks your infrastructure definitions for insecure configuration before they're deployed - the cheapest place to fix a misconfiguration.

What it covers

• Terraform, CloudFormation, Kubernetes manifests, and similar.
• Common misconfigurations: public storage buckets, open security groups, unencrypted volumes, over-permissive IAM, missing logging, etc.

Run an IaC scan

1. From Repositories, scan a repo containing IaC files.
2. apPosture detects the IaC type and evaluates policy checks.
3. Findings appear here and in Vulnerabilities.

Reading an IaC finding

• Resource & file/line of the misconfiguration.
• Policy/check that failed, severity, and the secure configuration to apply.

Shift left

IaC findings are best enforced as a CI/CD gate so a risky configuration can't merge in the first place.