IaC Security

What is IaC Security?

IaC security checks detect security misconfigurations in infrastructure-as-code files (such as Terraform, CloudFormation, Kubernetes YAML, and Dockerfile) before deployment, including public S3 buckets, missing encryption, and overly broad permissions. Because infrastructure misconfigurations can cause broader damage than application vulnerabilities, blocking them at the code review stage is critical.

The configuration below is an example — a fully working implementation lives in the reference repository

The YAML and commands on this page are examples that show the essentials. For a complete, copy-and-run pipeline (including policy files and a sample app), see the Best Practice repository.

---

Tool Comparison

Tool	Key Characteristics	Supported Targets	License
Checkov	Broad coverage + custom policy support	Terraform, K8s, CF, Dockerfile, ARM	Apache-2.0
tfsec	Terraform-focused + fast	Terraform	MIT
Trivy	Includes IaC scan (integrated with container security)	Terraform, K8s, Dockerfile	Apache-2.0
Kubesec	Kubernetes-only security scoring	Kubernetes YAML	Apache-2.0

For multi-IaC environments, Checkov is recommended; for integration with container security, use Trivy. Maintenance of tfsec is being migrated to Trivy, so if you need Terraform-only checks, consider trivy config first.

---

Checkov Setup

Checkov provides more than 500 built-in policies and runs both locally and in CI without a separate server. It supports SARIF output, so integrating with the GitHub Security tab lets you review results directly in PRs.

Basic Usage

Bash

# scan entire current directory
checkov -d .

# scan specific framework only
checkov -d . --framework terraform
checkov -d . --framework kubernetes

# run specific checks only
checkov -d . --check CKV_AWS_18,CKV_AWS_19

# output results as JSON
checkov -d . -o json > checkov-report.json

GitHub Actions

YAML

# .github/workflows/iac-security.yml

name: IaC Security — Checkov

on:
  pull_request:
    branches: [main, develop]

jobs:
  checkov:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Run Checkov
        uses: bridgecrewio/checkov-action@master
        with:
          directory: .
          framework: terraform,kubernetes,dockerfile
          soft_fail: false
          output_format: cli,sarif
          output_file_path: console,checkov-results.sarif

      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: checkov-results.sarif

GitLab CI

YAML

# .gitlab-ci.yml (iac-security job section)

iac-security:
  stage: test
  image: bridgecrew/checkov:latest
  script:
    # exit 1 on violations (hard fail) is the default behavior
    - checkov -d .
      --framework terraform,kubernetes,dockerfile
      --output cli
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

---

tfsec Setup (Terraform-only)

tfsec is specialized for Terraform, runs quickly, and includes built-in security rules for major cloud providers such as AWS, Azure, and GCP. However, its maintenance is being migrated to Trivy, so for new adoption consider trivy config first. It is also useful alongside Checkov when you want deeper Terraform-specific checks.

GitHub Actions

YAML

# .github/workflows/iac-security-tfsec.yml (Terraform only)

name: IaC Security — tfsec

on:
  pull_request:
    branches: [main]

jobs:
  tfsec:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Run tfsec
        uses: aquasecurity/tfsec-action@v1.0.3
        with:
          soft_fail: false

---

Exception Handling

Keep exceptions traceable by declaring them inline in code

If you must skip specific checks, document the reason with inline comments in infrastructure code.

Hcl

# Terraform inline exception example

resource "aws_s3_bucket" "logs" {
  bucket = "my-log-bucket"

  # checkov:skip=CKV_AWS_18:access-log bucket does not require self-logging
  # checkov:skip=CKV_AWS_52:MFA delete protection unnecessary for log bucket
}

YAML

# Kubernetes inline exception example

metadata:
  annotations:
    checkov.io/skip1: 'CKV_K8S_14=test-environment-only pod'

---

Key Checks

The items below are major root causes of real incidents

At initial adoption, enabling these checks first can quickly reduce real risk. After the team gets used to results, expand to the full policy set.

Item	Checkov ID	Description
Block S3 public access	CKV_AWS_53	Configure bucket public access blocking
S3 encryption	CKV_AWS_19	Enable server-side encryption
Security group 0.0.0.0	CKV_AWS_24	Disallow SSH port (22) open to the world
Prevent root in K8s	CKV_K8S_23	Block containers running as root
K8s resource limits	CKV_K8S_11 · CKV_K8S_13	Set CPU limits and memory limits
K8s secret management	CKV_K8S_35	Inject secrets as files instead of environment vars

---

IaC Security Fixer

Upload a Checkov result file to automatically generate fixed code for each violation. It provides directly applicable fixed files, not just reports.

Preview with a sample first (no API key required)

You can view the fixed code for a pre-built sample scan result right away, without an API key. Get a feel for what the tool produces first, then run a real analysis on your own results below.

Fix your own results

This tool requires an Anthropic API key

It calls the Anthropic API directly from your browser. Enter your own Anthropic API key to use it right away. Your key and inputs are sent only from your browser to Anthropic (they never pass through a trustedoss server). Usage is billed to your own Anthropic account.

Self-Study

Generate IaC remediation code directly with Claude Code

The fixer above is available directly in your browser. If you need full files generated with fixes directly applied to original .tf files, use the agent below.

Prerequisite: Clone the Trusted OSS repository

Bash

cd agents/iac-fixer
claude

The agent automatically performs the following:

• Automatically parses Checkov result files (JSON)
• Generates direct remediation code for fixable findings
• Inserts checkov:skip comments for non-fixable items
• Generates full fixed files when originals are provided

---

Next Steps

• Verify after deployment with dynamic analysis: DAST
• Integrate the full pipeline: Pipeline Design