intermediate 25 min read cicd-integration Updated: 2025-06-28

IaC Security Scanning: A Practical Guide

A practical guide to integrating automated security scanning into your Infrastructure as Code (IaC) workflows to prevent vulnerabilities before deployment.

📋 Prerequisites

  • Basic knowledge of an IaC tool (Terraform or CloudFormation).
  • Access to a CI/CD system (examples use GitHub Actions).
  • Familiarity with the command line.
  • A code editor like VS Code.

What You'll Learn

🏷️ Topics Covered

terraform security scanning toolscheckov terraform integrationtfsec cloudformation scanningiac security automationinfrastructure security scanningterraform vulnerability scanning

Why IaC Scanning is Essential

Infrastructure as Code (IaC) allows us to define and manage infrastructure with code, but it also means that misconfigurations can be codified and replicated just as easily. IaC security scanning analyzes these definition files (e.g., .tf or .yaml) for security flaws before they are ever deployed. This is a core tenet of DevSecOps and "shifting left"—finding and fixing problems at the earliest, cheapest stage.

Checkov

A widely-used, Python-based scanner by Bridgecrew with a massive library of built-in policies. Best for broad framework support and graph-based analysis.

tfsec

A fast, Go-based scanner by Aqua Security focused specifically on Terraform, known for its speed and developer-friendly output.

Terrascan

A flexible, Go-based scanner from Tenable that supports a wide range of IaC tools and can be run as a server for API-based scanning.

Scanning IaC Files Locally

Let's walk through a practical example using Checkov, a popular open-source scanner. First, create a file named main.tf with a deliberately insecure S3 bucket configuration.

Insecure Terraform Code: main.tf

resource "aws_s3_bucket" "insecure_bucket" {
  bucket = "my-super-insecure-app-bucket-12345"

  # This makes the bucket public!
  acl = "public-read" 
}

resource "aws_s3_bucket_server_side_encryption_configuration" "insecure_bucket_sse" {
  bucket = aws_s3_bucket.insecure_bucket.id

  # Encryption is NOT enabled here. This block should not exist if encryption is off.
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

Now, install Checkov and run it against your directory. It will automatically discover and scan the Terraform files.

Install and Run Checkov

# Install Checkov using pip
pip install checkov

# Run the scan against the current directory
checkov -d .

Checkov will produce a detailed report in your terminal, highlighting the failed checks, providing remediation guidance, and linking to more information.

Automating Scans in a CI/CD Pipeline

The real power of IaC scanning comes from automation. Let's integrate Checkov into a GitHub Actions workflow to scan every pull request.

GitHub Actions Workflow: .github/workflows/iac-scan.yml

This workflow runs on every pull request that changes a Terraform file. It runs the scan, uploads the results to GitHub's "Security" tab, and fails the check if any issues are found.

name: IaC Security Scan

on:
  pull_request:
    paths:
      - '**.tf'

jobs:
  checkov-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run Checkov with Reviewdog
        uses: reviewdog/action-checkov@v1
        with:
          github_token: \${{ secrets.github_token }}
          reporter: github-pr-review # Post results as comments in the PR
          fail_on_error: true # Fail the pipeline on any error
          level: ERROR # Report only errors

Customizing Scans and Managing Findings

Sometimes you need to accept a risk or a check is a false positive for your specific use case. You can suppress findings with inline comments.

Suppressing a Finding in Code

To skip a specific check on a specific resource, add a formatted comment directly above it with a justification.

# checkov:skip=CKV_AWS_18:This bucket is for public website assets and must be public
resource "aws_s3_bucket" "insecure_bucket" {
  bucket = "my-super-insecure-app-bucket-12345"
  acl    = "public-read"
}

Best Practices for IaC Scanning

💡 Key Takeaways

  • Scan Early, Scan Often: Integrate scanning into pre-commit hooks for developers and into every pull request in your CI/CD pipeline.
  • Block the Build on Critical Issues: Configure your CI/CD pipeline to fail if high or critical severity vulnerabilities are detected. Don't let insecure code merge.
  • Establish a Triage Process: Have a clear process for reviewing, prioritizing, and either fixing or formally suppressing findings with a documented justification.
  • Combine with Policy-as-Code: IaC scanning is great for finding known "bads." Combine it with a policy engine like OPA or Sentinel to enforce your organization's specific "known good" configurations.
  • Educate Developers: Use the scanner's output and clear feedback loops as a tool to educate developers on secure coding practices for infrastructure.

🎉 Congratulations!

You now know how to build a foundational DevSecOps practice by integrating security into your IaC lifecycle. You have learned to scan IaC files locally, automate security scanning in a CI/CD pipeline, and manage findings.

To continue learning, explore our guides on Policy-as-Code vs. IaC Security, Testing Your Policies, and using OPA with Terraform.