implementing-infrastructure-as-code-security-scanning

Run Checkov against your Terraform directory with checkov -d ./terraform/ --framework terraform, or use tfsec for HCL-focused analysis. For higher accuracy, scan the resolved plan JSON produced by terraform show -json tfplan so computed values and module expansions are included.

Checkov offers 2500+ policies across many frameworks including Terraform, CloudFormation, Kubernetes, and Helm, plus graph-based relationship checks. tfsec focuses deeply on Terraform HCL, while KICS supports 15+ IaC frameworks. Running multiple scanners in parallel improves coverage.

Set soft_fail: false on the Checkov or tfsec GitHub Actions step so the scanner exits non-zero on failed checks and blocks the merge. Upload SARIF results with if: always() for reporting, but the gate comes from the failing scan job itself.

Common causes include soft_fail mode forcing exit code 0, scanning .tf source instead of the plan JSON so modules are skipped, over-broad skip-check suppressions, and graph checks (CKV2_ prefix) not running. Verify by adding a deliberately public S3 bucket and confirming the build fails.

Yes, Checkov scans Kubernetes manifests with --framework kubernetes and renders Helm charts before scanning with --framework helm. KICS is an alternative that supports Kubernetes via its Docker image with --type Kubernetes.

Do not use IaC scanning for application source code analysis (use SAST), for monitoring already-deployed infrastructure drift (use cloud security posture management), or for container image vulnerability scanning (use Trivy). It targets pre-deployment template misconfigurations only.