Infrastructure as Code (IaC) Scanning

Evaluates IaC templates against codified, version-controlled rules using engines like Open Policy Agent (OPA) and Checkov. This shifts governance left by failing CI/CD pipelines when a Terraform resource violates a compliance standard such as CIS Benchmarks or PCI DSS.

• Prevents non-compliant resources from being provisioned
• Uses the Rego language for custom, fine-grained logic
• Enforces organizational tagging standards and encryption requirements

Scans configuration files, state files, and commit history for hardcoded credentials, API keys, and tokens. Tools like truffleHog and git-secrets use high-entropy string analysis and regex pattern matching to identify exposed secrets before they reach a remote repository.

• Detects AWS Access Keys, SSH private keys, and database connection strings
• Prevents secret leakage in Terraform state files
• Integrates with pre-commit hooks to block commits containing secrets

Continuously compares the declared desired state in IaC files against the actual running state in the cloud. Drift detection identifies manual changes made via a console (ClickOps) that bypass the GitOps workflow, alerting teams to unauthorized modifications.

• Highlights configuration drift in real-time
• Enforces immutable infrastructure principles
• Automatically triggers reconciliation jobs to revert unauthorized changes

Builds a graph model of provisioned network paths to identify overly permissive ingress rules. Scanners flag 0.0.0.0/0 CIDR blocks, unrestricted port ranges, and security groups that expose databases or admin panels to the public internet.

• Visualizes attack paths before deployment
• Flags violations of least-privilege network access
• Validates that internal services are not inadvertently exposed

Recursively analyzes external modules, providers, and container base images referenced in IaC code. This identifies vulnerable dependencies and supply chain risks in components like Terraform modules sourced from public registries.

• Scans Dockerfiles embedded in IaC for OS vulnerabilities
• Checks pinned module versions against CVE databases
• Prevents dependency confusion attacks in private module registries

Analyzes IaC plans to predict cloud costs and prevent resource exhaustion. Scanners flag the provisioning of expensive instance types or unbounded auto-scaling groups that could lead to bill shock or accidental Denial of Wallet scenarios.

• Estimates monthly cost impact directly in pull requests
• Blocks deployment of deprecated or non-allowlisted instance types
• Enforces budget tagging and resource lifecycle policies

A class of security tools that continuously monitor and remediate misconfigurations and compliance risks across cloud infrastructure, IaaS, and PaaS environments. While IaC scanning operates at the pre-deployment stage, CSPM provides runtime visibility:

• Detects drift from the IaC-defined baseline
• Identifies resources provisioned outside the IaC workflow (shadow IT)
• Maps misconfigurations to compliance frameworks like CIS Benchmarks

A deployment paradigm where servers and containers are never modified after provisioning. Any configuration change requires destroying the existing component and replacing it with a new, validated version. IaC scanning is the gatekeeper of this paradigm:

• Every change flows through a pipeline where scanning occurs
• Drift detection tools compare live state against the scanned, approved template
• Eliminates configuration snowflakes and manual hotfixes that bypass security review