Security scanning

What is IaC scanning?

Checking infrastructure-as-code files (Terraform, CloudFormation, Kubernetes manifests, Dockerfiles) for insecure configuration before it is applied.

By Cláudia FernandesUpdated 2026-10-02

A large share of cloud security incidents trace back to configuration rather than application code: a public storage bucket, an over-permissive IAM role, an unencrypted volume. IaC scanning catches these in the pull request that would have created them.

The leverage comes from reuse: a single misconfigured module can be copied across dozens of environments, and fixing the template fixes all of them at once. The limit is that it only sees what is in code. Resources created in the console, drift after deployment and settings that depend on runtime values are outside its view, which is the gap cloud posture scanning covers.

What to look for

Format coverage for your stack, including Helm charts and Kustomize if relevant
Whether Terraform modules and variables are resolved, or files read in isolation
Custom policy support, and in which language (Rego, YAML, proprietary)
Whether findings map to CIS benchmarks or your compliance framework

Best 13 IaC scanning tools

Every tool in the directory whose documentation covers this, 11 fully and 2 partially. Full support is shown first. Shown in a random order that changes on every visit, so no tool gets an advantage from its position.

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

Code Security Platform

Aikido

Terraform, CloudFormation, Kubernetes, Docker, Helm, Ansible, ARM, Bicep, Pulumi, CDK, Serverless

Code Security Platform

Checkmarx One

KICS engine across Ansible, CloudFormation, Dockerfile, Kubernetes, Terraform, Docker Compose, Crossplane, Pulumi, NifCloud.

Code Quality Platform

Codacy

Checkov, Hadolint, Spectral cover Terraform, CloudFormation, Kubernetes, Dockerfile, Helm, GitHub Actions, Ansible.

PR Review Tool

CodeAnt AI

Terraform scanning, cloud security policies (vendor states 100+, uncorroborated) across AWS, Azure, GCP, Alibaba, drift detection

PR Review Tool

CodeRabbit

Checkov, TFLint, Hadolint, zizmor, actionlint; Deep Scan covers Terraform, Kubernetes, Helm, ARM

Code Security Platform

Corgea

Terraform, CloudFormation, Kubernetes, Docker, Helm, Azure ARM

Code Quality Platform

DeepSource

Dedicated Dockerfile, Terraform, and Ansible analyzers; community analyzers add CloudFormation and Kubernetes.

Code Quality Platform

Qlty

Trivy, Checkov, Hadolint, ShellCheck, TFLint, KubeLinter over Terraform, CloudFormation, Dockerfiles, Helm, Kubernetes

Code Security Platform

Snyk

Terraform, CloudFormation, Kubernetes, Helm, ARM, AWS CDK, Serverless; CCSS severity; custom-rule SDK.

Code Quality Platform

SonarQube

Ansible, Azure Resource Manager, CloudFormation, Docker, Kubernetes/Helm, Terraform misconfiguration rules.

Code Security Platform

Veracode

IaC misconfiguration scanning via repository integrations and CLI scan command with Rego custom policy

Code Security Platform

GitHub Advanced Security

CodeQL scans GitHub Actions workflows; no Terraform, Kubernetes or CloudFormation IaC scanning documented

Code Security Platform

Semgrep

Dockerfile and YAML appear only as experimental-maturity community-rule languages; no IaC product or Terraform support documented.

SAST Taint Analysis (Data-Flow)Secrets Detection Secrets Validation SCA Reachability Analysis

FAQ