Unify infrastructure findings
The native rule and checkov flagging the same resource become one logical finding with a corroborating edge.
Find configuration risk
before it ships.
Scan infrastructure as code (IaC) for security misconfigurations. Keep the finding connected to its template and the resources it describes.
Infrastructure change
Resource declaration
Network access rule
Deployment configuration
Investigation context
01 / Read the change
Inspect infrastructure as code.
- Template path
- Resource address
Review configuration in the source template before it becomes deployed infrastructure.
02 / Explain the risk
Tie the finding to a setting.
- Rule reference
- Affected setting
Show the configuration evidence so the developer can understand the rule.
03 / Check the revision
Review the fix in the same workflow.
- Code revision
- Policy evaluation
Connect the revised template to the follow-up scan and policy review.
Rendered
Helm and Kustomize
Rules see the effective manifest.
CI/CD
Workflow checks
GitHub Actions and GitLab CI.
checkov
Waivers honoured
Through an explicit rule mapping.
Unresolved
Is never safe
Unrendered values never pass a check.
The category
What is IaC security scanning?
IaC scanning applies policy to the definition of infrastructure rather than to the infrastructure itself. It catches the problem in the pull request that introduces it, with an owner and a line number. Its blind spot is indirection: values that arrive through variables, templates and overlays, which a scanner reading raw text never sees.
SecurityVault resolves supported Helm values, Kustomize overlays and literal Terraform defaults before applying checks. Static resolution does not replace a full deployment plan or live posture assessment. Unresolved values remain visible. The finding lands on one graph with your code, images and live cloud posture, and a fail-closed gate stops the change in review. Platform teams get one finding per issue with a file and a line number, not a raw rule dump.
Definition
Read the Terraform, Kubernetes or Helm configuration.
Misconfiguration
Locate the setting that violates a rule.
Change review
Evaluate the finding before the deployment runs.
The configuration file remains the developer’s starting point for a fix.
How SecurityVault does it
How does SecurityVault check infrastructure as code?
Native engine
Rule-based checks over the IaC resources the project graph collects from Terraform, CloudFormation, Kubernetes manifests and Dockerfiles, including a Dockerfile's final runtime user.
Templates
Helm
.Values references, including the toYaml | nindent idiom, are substituted from values.yaml, and Kustomize overlays are composed where supported. Review unresolved expressions and validate the rendered deployment through your normal infrastructure workflow.Variables
Terraform variable defaults that are literals are resolved into the resource text, so
cidr_blocks = [var.public] with a default of 0.0.0.0/0 is caught.Pipelines
Workflow checks for GitHub Actions and GitLab CI flag actions pinned to a mutable tag instead of a SHA, missing token permission blocks,
pull_request_target running untrusted fork code with secrets, artifact poisoning between workflows, and credentials hard-coded in env.Open source
checkov runs on every repository scan beside the native engine; kics and terrascan are available as additional adapters. Results that agree resolve to one finding.
After the scan
What happens to an IaC finding?
It lands on the same graph as code, dependency and image findings, attached to the repository and the commit that introduced the misconfiguration.
Finding
affects
Repository
contains
Commit
triggered
Build
produces
ContainerImage
runs_image
Workload
01
02
Waivers carried over
Existing checkov skips keep working through an explicit rule mapping, and every waiver stays visible with its reason.
03
Paired with live posture
The definition is checked here; the deployed resource is checked by cloud posture on the same graph.
Gates
Can an IaC misconfiguration block a merge?
Yes, before terraform apply or a Helm release ever runs. The pull-request or pipeline gate weighs IaC findings against your severity threshold and organisation policies. A failed or timed-out scan is a deny, and so is an evaluator error. Kubernetes workloads get a second checkpoint at admission, so a manifest applied outside the pipeline still meets policy before it runs. See deployment gates, Kubernetes security and policy-as-code gates with OPA.
Pull request
Evaluate findings before terraform apply or Helm release.
Admission
Check Kubernetes workloads entering the cluster.
Failure handling
Deny when scanning or evaluation cannot complete.
A deployment outside the pipeline still meets admission policy.
Evidence
Who approved that exception, and why?
Every waiver and inline suppression is recorded with its reason, so an exception in a Terraform module is a reviewed decision, not a silent skip. IaC findings are recorded as infrastructure evidence when controls are evaluated, and the cross-walk maps that evidence across 6 seeded framework catalogues, CIS among them, to the configuration controls in your audit.
Configuration finding
Identify the definition being reviewed.
Waiver rationale
Retain the reason for an exception or suppression.
Control mapping
Use the infrastructure evidence in the audit cross-walk.
An exception is a recorded decision, not a silent skip.
FAQ
Frequently asked questions about IaC security
- Which IaC formats are checked?
- Terraform, CloudFormation, Kubernetes manifests and Dockerfiles natively, with Helm values and Kustomize overlays resolved before the rules run. GitHub Actions and GitLab CI workflow files get their own checks. checkov runs on every repository scan, with kics and terrascan available as additional adapters.
- We already annotate checkov skips. Will SecurityVault re-flag them?
- A resource-scoped checkov waiver also waives the equivalent native rule, through an explicit, finite mapping between checkov IDs and native rules. A waiver for one check is never stretched to cover a different class of problem.
- What happens when a Helm template cannot be fully rendered?
- The unresolved expression is left in place and recorded as unresolved, never read as a safe value. A rule that fires when a setting is absent keeps firing, because an unrendered template is never read as the setting being present.
- What do the CI workflow checks look for?
- Actions pinned to a mutable tag instead of a commit SHA, workflows with no explicit token permissions, pull_request_target workflows that run untrusted fork code with secrets, artifact poisoning between workflows, and credentials hard-coded in env blocks.
- Are Terraform variables resolved?
- Literal defaults are. A variable with a literal default value is substituted into the resource before the rules run, so a CIDR passed through a variable is still checked.
Platform offerings
What is coming next for IaC security?
- IaC findings linked to the live cloud resource each definition provisioned.
The definition is half the picture. Cloud posture (CSPM) checks the deployed resource, Kubernetes security enforces settings at admission, and threat modeling turns the same Terraform into a data-flow diagram. Built for security engineers and developers who own the infrastructure code. See cloud posture. Glossary: IaC scanning, misconfiguration, policy as code.
From the blog
Further reading
- Terraform drift: reconcile an emergency changeReview Terraform drift after an emergency change by comparing configuration, state and live resources before choosing a controlled reconciliation.
- IaC drift: close findings on live evidence, not on mergeIaC drift means a merged fix is not a deployed one. Link each IaC finding to the cloud resource it created and close it on evidence from the account.
- IaC scanning before apply: catch misconfigurations in the PRIaC scanning catches Terraform, Kubernetes and CloudFormation misconfigurations at pull-request time, while the fix is still a one-line change.
See it on your stack
Bring one infrastructure repository.
See Helm and Terraform checked as rendered, with one finding per issue and a gate on the pull request.