Infrastructure as Code security scanning finds misconfigurations in Terraform, CloudFormation, and Kubernetes before they reach production. This guide covers every major IaC scanner and how to pair them with runtime web security monitoring.
Anay Pandya
1,416 words
Anay Pandya
Founder of ZeriFlow · 10 years fullstack engineering · About the author
Key Takeaways
Infrastructure as code security scanning is the practice of automatically identifying misconfigurations in IaC templates — Terraform, CloudFormation, Kubernetes manifests, Helm charts, Docker Compose files — before they are deployed. A publicly exposed S3 bucket, an unrestricted security group, or an unencrypted RDS instance can all be prevented at the code level if you scan your IaC.
<div class="zf-stat-callout" style="background:#0d1117;border:1px solid rgba(16,185,129,0.25);border-left:3px solid #10b981;border-radius:4px;padding:16px 20px;margin:24px 0"> <p style="margin:0 0 4px;font-size:10px;font-weight:700;text-transform:uppercase;letter-spacing:0.15em;color:#10b981;font-family:monospace">ZeriFlow Data — 12,400+ sites analyzed</p> <p style="margin:0;font-size:13px;color:#e2e8f0;line-height:1.6;font-family:monospace">In ZeriFlow's dataset of 12,400+ scanned sites, the average security score is 52/100 — with 68% failing at least one critical check in categories including TLS configuration, , DNS authentication, and cookie handling.</p> </div>
Keep reading
Is your site actually secure?
Run a free check — 60 seconds
This guide covers the major IaC security tools (Checkov, tfsec, KICS), common misconfiguration categories, CI/CD integration strategies, and how to use ZeriFlow to monitor the web-facing security of your deployed infrastructure.
Monitor your deployed infrastructure: After deploying your IaC, run ZeriFlow to verify that your web application's security configuration — headers, TLS, exposed paths — is correct. 80+ checks, zero setup required.
The 2019 Capital One breach — which exposed 100 million customer records — originated from a misconfigured AWS WAF. The 2017 Accenture exposure — 137GB of sensitive data — came from publicly accessible S3 buckets. The 2021 Twitch breach involved infrastructure misconfiguration.
These breaches share a common pattern: cloud infrastructure misconfigurations that would have been trivially detectable by automated scanning at the code level. IaC security scanning catches these before deployment:
Checkov by Bridgecrew is the most comprehensive open-source IaC security scanner:
Supported frameworks: - Terraform (AWS, GCP, Azure, Oracle) - CloudFormation - Kubernetes / Helm - Dockerfiles - GitHub Actions / GitLab CI - Azure Pipelines - Serverless Framework
Installation and basic usage:
pip install checkov
# Scan a Terraform directory
checkov -d ./terraform
# Scan a specific file
checkov -f main.tf
# Scan CloudFormation
checkov -f template.yaml --framework cloudformation
# Scan Kubernetes manifests
checkov -d ./k8s --framework kubernetes
# Output formats
checkov -d ./terraform --output json > checkov-results.json
checkov -d ./terraform --output sarif > checkov-results.sarifCompact output (show only failures):
checkov -d ./terraform --compact --quietSetting a failure threshold:
# Fail if any HIGH or CRITICAL severity checks fail
checkov -d ./terraform --check CKV_HIGH,CKV_CRITICALExample findings Checkov catches:
Check: CKV_AWS_20: 'Ensure the S3 bucket has access control list (ACL) applied and is not public'
FAILED for resource: aws_s3_bucket.data_bucket
File: /terraform/main.tf:15-25
Check: CKV_AWS_8: 'Ensure that EC2 instances use Instance Metadata Service Version 2 (IMDSv2)'
FAILED for resource: aws_instance.web_server
File: /terraform/ec2.tf:5-20tfsec is a Terraform-focused IaC scanner with excellent speed and CI/CD friendliness:
# Install
brew install tfsec
# or
go install github.com/aquasecurity/tfsec/cmd/tfsec@latest
# Basic scan
tfsec .
# Scan with severity filter
tfsec . --minimum-severity HIGH
# Output formats
tfsec . --format json > tfsec-results.json
tfsec . --format sarif > tfsec-results.sarif
# Specific checks
tfsec . --include-passed
tfsec . --exclude-checks aws-s3-enable-bucket-encryptiontfsec vs. Checkov: tfsec is Terraform-only but extremely fast and produces very clean output. Checkov covers more frameworks. Use tfsec for Terraform-heavy environments; use Checkov for multi-framework environments.
KICS by Checkmarx is a comprehensive multi-framework IaC scanner:
# Install via Docker
docker pull checkmarx/kics:latest
# Scan Terraform
docker run -t -v $(pwd):/path checkmarx/kics:latest scan -p /path/terraform -o /path/results --report-formats json,html
# Scan Kubernetes manifests
docker run -t -v $(pwd):/path checkmarx/kics:latest scan -p /path/k8s --type KubernetesKICS stands out for its broad support and its ability to scan mixed-framework repositories in a single pass.
Vulnerable Terraform:
resource 'aws_s3_bucket' 'data' {
bucket = 'my-data-bucket'
acl = 'public-read' # DANGEROUS
}Secure Terraform:
resource 'aws_s3_bucket' 'data' {
bucket = 'my-data-bucket'
}
resource 'aws_s3_bucket_public_access_block' 'data' {
bucket = aws_s3_bucket.data.id
block_public_acls = true
block_public_policy = true
ignore_public_acls = true
restrict_public_buckets = true
}Vulnerable:
resource 'aws_security_group_rule' 'ssh' {
type = 'ingress'
from_port = 22
to_port = 22
protocol = 'tcp'
cidr_blocks = ['0.0.0.0/0'] # DANGEROUS: SSH open to the world
}Secure:
resource 'aws_security_group_rule' 'ssh' {
type = 'ingress'
from_port = 22
to_port = 22
protocol = 'tcp'
cidr_blocks = [var.vpn_cidr] # Only from VPN
}Vulnerable:
apiVersion: apps/v1
kind: Deployment
spec:
template:
spec:
containers:
- name: app
image: myapp:latest
# No securityContext = runs as rootSecure:
spec:
template:
spec:
securityContext:
runAsNonRoot: true
runAsUser: 1000
containers:
- name: app
image: myapp:latest
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop:
- ALLname: IaC Security Scan
on:
pull_request:
paths:
- 'terraform/**'
- 'k8s/**'
jobs:
checkov:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run Checkov
uses: bridgecrewio/checkov-action@master
with:
directory: terraform/
framework: terraform
output_format: sarif
output_file_path: results.sarif
soft_fail: false
check: CKV_AWS_*
- name: Upload SARIF to GitHub Security
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: results.sariftfsec_scan:
image: aquasec/tfsec-ci:latest
script:
- tfsec . --format json --out gl-sast-report.json --minimum-severity HIGH
artifacts:
reports:
sast: gl-sast-report.jsonIaC scanning and web application security scanning operate at different layers:
| IaC Security Scanning | Web Security Scanning (ZeriFlow) | |
|---|---|---|
| When | Pre-deployment (code review) | Post-deployment (runtime) |
| What it checks | Cloud resource config, IAM, network | HTTP headers, TLS, exposed paths |
| Examples | Public S3, open security groups | Missing CSP, weak TLS, no HSTS |
| Tools | Checkov, tfsec, KICS | ZeriFlow, OWASP ZAP, Nikto |
Even with perfect IaC security, your web application layer can still have misconfigured security headers or weak TLS. These are set at the application or web server level (nginx, Apache, CloudFront, load balancer configuration), not in your Terraform code.
This is why pairing IaC scanning with ZeriFlow gives you complete coverage: - IaC scanners ensure your infrastructure is correctly configured. - ZeriFlow ensures your application's HTTP-level security posture is correct.
A: Run a fast scan on every PR that touches IaC files (Checkov takes 10-30 seconds). This gives developers immediate feedback. Also run scanning during terraform plan to catch any drift between the code and the actual plan output.
A: Most IaC scanners support inline suppression comments:
#checkov:skip=CKV_AWS_18:S3 access logging not required for this bucket
resource 'aws_s3_bucket' 'logs' {
bucket = 'app-logs'
}Document your reasoning and review suppressions quarterly.
A: IaC scanners have some secret detection, but dedicated secret scanners (Gitleaks, TruffleHog) are better at this. Always run both: IaC scanners for configuration issues, secret scanners for credentials.
A: Yes. Checkov (the CLI tool) is completely open-source and free. Bridgecrew/Prisma Cloud (the commercial platform built on top) adds dashboards, drift detection, and runtime monitoring for a fee.
A: ZeriFlow focuses on the web application layer — HTTP security headers, TLS/SSL configuration, exposed paths, cookie attributes, and DNS security. For cloud infrastructure misconfiguration (S3, security groups, IAM), use Checkov, tfsec, or KICS. The two layers are complementary.
IaC security scanning is one of the highest-leverage security investments for cloud-native teams. A single Checkov check in your pipeline prevents the class of misconfigurations responsible for some of the largest data breaches in recent years.
Implement Checkov or tfsec in your Terraform pipeline today. Add KICS for multi-framework environments. Block PRs on High and Critical severity findings.
And after deployment, run ZeriFlow to verify that your web-facing security configuration — the HTTP headers, TLS settings, and exposed paths that IaC scanners cannot see — is as secure as the infrastructure underneath it.
<!-- zf-internal-links -->
Related resources
Website Vulnerability Scanner
Run a broader website security audit across headers, TLS, DNS, cookies, SEO, and disclosure checks.
Security Headers Checker
Check CSP, HSTS, X-Frame-Options, and other response headers.
SSL Checker
Review TLS certificate, HTTPS, and transport security signals.
DMARC Checker
Validate email authentication records for domain spoofing protection.
CSP Checker
Review Content-Security-Policy coverage and common gaps.
June 24, 2026
Best Security Tools for AI Startups
Monitor your security score
Schedule recurring scans and catch regressions after deployments.