skills.rest
hardw00t
hardw00tCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

iac-security

Scan Infrastructure as Code configurations for misconfigurations and policy violations.

90|14|Updated Jan 12, 2026
Search Tags:#ci/cd#security#cloudformation#kubernetes#terraform#iac#scanning
One-click install
npx skills add https://github.com/hardw00t/ai-security-arsenal --skill iac-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: iac-security
Source: https://github.com/hardw00t/ai-security-arsenal/tree/main/skills/iac-security
Command: npx skills add https://github.com/hardw00t/ai-security-arsenal --skill iac-security

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps development and operations teams identify security misconfigurations in Infrastructure as Code before deployment, reducing risk and remediation costs.

Core Features & Use Cases

  • IaC security scanning across Terraform, CloudFormation, Kubernetes manifests, Helm charts, Pulumi, and ARM templates to detect misconfigurations and policy violations.
  • CI/CD integration to automatically embed security checks into pull requests and deployment pipelines.
  • Policy compliance checks against CIS benchmarks, Kubernetes security policies, and provider best practices to enforce secure infrastructure.
  • Use Case: When reviewing a Terraform plan, run scans to surface misconfigurations, enforce least privilege, and generate a remediation report.

Quick Start

Install and run the scanners in your environment. For example:

  • Run Checkov for Terraform, Kubernetes, and CloudFormation: checkov -d . --framework terraform,kubernetes,cloudformation
  • Run tfsec for Terraform: tfsec . --format json > tfsec.json
  • Run kubesec for Kubernetes manifests: kubesec scan deployment.yaml
  • Integrate into CI/CD using a simple pipeline that triggers on pull requests

Frequently Asked Questions about iac-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan Terraform and CloudFormation for security misconfigurations?▼

To scan Terraform and CloudFormation for security misconfigurations, you can run tools like Checkov or tfsec against your IaC directories to detect policy violations and enforce secure infrastructure practices before deployment.

Can I integrate infrastructure as code security scanning into my CI/CD pipeline?▼

Yes, you can integrate infrastructure as code security scanning into your CI/CD pipeline by configuring scanners to trigger on pull requests, automatically surfacing misconfigurations and enforcing least privilege during the review process.

Do I need to install external scanners to check Kubernetes manifests for policy compliance?▼

Yes, you need external scanners like Checkov, kubesec, or Trivy installed or run in containers in your execution environment to check Kubernetes manifests for policy compliance against CIS benchmarks and security policies.

What is the best way to enforce security policies across Helm charts and ARM templates?▼

The best way to enforce security policies across Helm charts and ARM templates is to run automated IaC security scans during development, which identifies misconfigurations and checks compliance against provider best practices.

How does automated IaC scanning reduce remediation costs for cloud infrastructure?▼

Automated IaC scanning reduces cloud infrastructure remediation costs by identifying security misconfigurations in Infrastructure as Code before deployment, catching policy violations early during development and review workflows.

Related Skills

Explore More Software Engineering Skills→
devkenidevkeni
1

iac-security

Scan Infrastructure as Code for security misconfigurations using Checkov, tfsec, and Trivy.

Community
Intermediate
jovermierjovermier
1

security-sentinel

Automate security auditing to identify vulnerabilities and OWASP Top 10 risks.

Community
Advanced
alxayoalxayo
17

checkov-security-scan

Detect security misconfigurations and compliance violations in Infrastructure as Code.

Community
Advanced
haJ1thaJ1t

mcp-infra-scanner

Scan cloud infrastructures for misconfigurations and compliance gaps via MCP.

Community
Advanced