Analysis & detection
What is IaC Scanning?
Checking infrastructure-as-code, such as Terraform, CloudFormation, Kubernetes manifests, Dockerfiles, for insecure configuration before it is applied.
Most cloud breaches trace back to configuration rather than application code: a public storage bucket, an over-permissive IAM role, an unencrypted volume. IaC scanning catches these in the pull request that would have created them.
It is the highest-leverage scanning type per unit of effort, because a single misconfigured module can be reused across dozens of environments, and fixing the template fixes all of them at once.
Top 13 IaC Scanning tools
Every tool in the directory documented as supporting IaC Scanning, 11 fully, 2 partially, with what its own documentation says.
Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.
- 1
Checkov, Hadolint, Spectral cover Terraform, CloudFormation, Kubernetes, Dockerfile, Helm, GitHub Actions, Ansible.
- 2AikidoCode Security Platform
Terraform, CloudFormation, Kubernetes, Docker, Helm, Ansible, ARM, Bicep, Pulumi, CDK, Serverless
- 3Checkmarx OneCode Security Platform
KICS engine across Ansible, CloudFormation, Dockerfile, Kubernetes, Terraform, Docker Compose, Crossplane, Pulumi, NifCloud.
- 4CodeAnt AIPR Review
Terraform scanning, cloud security policies (vendor states 100+, uncorroborated) across AWS, Azure, GCP, Alibaba, drift detection
- 5
Checkov, TFLint, Hadolint, zizmor, actionlint; Deep Scan covers Terraform, Kubernetes, Helm, ARM
- 6CorgeaCode Security Platform
Terraform, CloudFormation, Kubernetes, Docker, Helm, Azure ARM
- 7DeepSourceQuality Platform
Dedicated Dockerfile, Terraform, and Ansible analyzers; community analyzers add CloudFormation and Kubernetes.
- 8
Trivy, Checkov, Hadolint, ShellCheck, TFLint, KubeLinter over Terraform, CloudFormation, Dockerfiles, Helm, Kubernetes
- 9SnykCode Security Platform
Terraform, CloudFormation, Kubernetes, Helm, ARM, AWS CDK, Serverless; CCSS severity; custom-rule SDK.
- 10SonarQubeQuality Platform
Ansible, Azure Resource Manager, CloudFormation, Docker, Kubernetes/Helm, Terraform misconfiguration rules.
- 11
IaC misconfiguration scanning via repository integrations and CLI scan command with Rego custom policy
- 12GitHub Advanced SecurityCode Security PlatformPartialFree on public repos; add-on: Code Security for private
CodeQL scans GitHub Actions workflows; no Terraform, Kubernetes or CloudFormation IaC scanning documented
- 13
Dockerfile and YAML appear only as experimental-maturity community-rule languages; no IaC product or Terraform support documented.
What to look for
- Format coverage for your stack, including Helm charts and Kustomize if relevant
- Whether Terraform modules and variables are resolved, or files read in isolation
- Custom policy support, and in which language (Rego, YAML, proprietary)
- Whether findings map to CIS benchmarks or your compliance framework
Related terms
FAQ
What is IaC Scanning?
Checking infrastructure-as-code, such as Terraform, CloudFormation, Kubernetes manifests, Dockerfiles, for insecure configuration before it is applied.
How many tools support IaC Scanning?
13 of the 20 tools tracked in this directory support IaC Scanning, 11 fully and 2 partially, including Codacy, Aikido, Checkmarx One, CodeAnt AI, CodeRabbit. Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.
What should you look for in IaC Scanning?
Format coverage for your stack, including Helm charts and Kustomize if relevant. Whether Terraform modules and variables are resolved, or files read in isolation. Custom policy support, and in which language (Rego, YAML, proprietary). Whether findings map to CIS benchmarks or your compliance framework.