Infrastructure as Code Security

Thin router for IaC static analysis. Pick the right workflow, run scanners in parallel, aggregate findings into schemas/finding.json, and (where org controls demand it) author Rego policies via the policy-as-code loop. Detailed per-stack commands and rule references live under references/; multi-step runbooks live under workflows/.

When to Use

• Scan Terraform .tf / plan JSON for misconfigurations
• Audit CloudFormation YAML/JSON templates
• Validate Kubernetes manifests (incl. rendered Helm / kustomize)
• Validate Helm charts pre- and post-render
• Scan ARM / Bicep templates for Azure misconfigurations
• Verify CIS benchmark compliance across AWS / Azure / GCP / K8s
• Integrate IaC scanning into PR gates or pre-commit hooks
• Author custom OPA/Rego policies for org-specific controls

Trigger Phrases

• "scan this Terraform / audit my CloudFormation / check Kubernetes manifests"
• "validate Helm chart security" · "IaC security scan" · "infrastructure compliance"
• "write a Rego policy for X" · "add Conftest rule for Y"