iac-security-review

Identify security misconfigurations in Terraform, Kubernetes, CloudFormation, and Helm IaC files.

141|14|Updated Mar 22, 2026
One-click install
npx skills add https://github.com/OWASP/secure-agent-playbook --skill iac-security-review-owasp
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: iac-security-review
Source: https://github.com/OWASP/secure-agent-playbook/tree/main/skills/iac-security-review
Command: npx skills add https://github.com/OWASP/secure-agent-playbook --skill iac-security-review-owasp

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security review of Infrastructure-as-Code (Terraform, Kubernetes, CloudFormation) to identify misconfigurations, overpermissive access, exposed resources, missing encryption, secrets in code, and supply chain risks.

Core Features & Use Cases

  • Systematic reviews across IaC platforms (Terraform/OpenTofu, Kubernetes, CloudFormation, Helm) to detect risks in identity, secrets, network, encryption, storage, logging, and exposure.
  • CIS benchmarks and cloud security best-practice checks to validate configurations and ensure compliance.
  • Produce actionable findings with severity, evidence, and remediation guidance for engineers and operators.

Quick Start

Analyze your IaC repository by providing the Terraform/Kubernetes/CloudFormation files to initiate the security review.

Frequently Asked Questions about iac-security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security review on Terraform and Kubernetes manifests?

Run a security review on Terraform and Kubernetes manifests by providing your IaC files to initiate automated checks. The tool analyzes configurations to identify exposed resources, missing encryption, and overpermissive access, producing actionable findings.

What is an infrastructure-as-code security review?

An infrastructure-as-code security review systematically validates Terraform, Helm, and CloudFormation templates against CIS benchmarks. It detects misconfigurations, secrets in code, and supply chain risks to ensure cloud security hardening before deployment.

What is an infrastructure-as-code security review?

An infrastructure-as-code security review systematically validates Terraform, Helm, and CloudFormation templates against CIS benchmarks. It detects misconfigurations, secrets in code, and supply chain risks to ensure cloud security hardening before deployment.

Can I check my CloudFormation templates against CIS benchmarks?

Yes, you can check CloudFormation templates against CIS benchmarks. The review enforces cloud provider best practices to validate identity, network, and storage configurations, ensuring your templates meet compliance requirements.

What is the best way to find secrets in code and exposed resources in IaC?

The best way to find secrets in code and exposed resources in IaC is to perform a structured security review across your repositories. This process detects supply chain risks and outputs prioritized findings with severity and evidence.

Does Helm chart security scanning cover network and storage misconfigurations?

Yes, Helm chart security scanning covers network and storage misconfigurations. The review systematically detects risks across identity, secrets, logging, and exposure categories, providing actionable remediation guidance for operators.