Iac Security

Infrastructure as Code Security

Thin router for IaC static analysis. Pick the right workflow, run scanners in parallel, aggregate findings into schemas/finding.json, and (where org controls demand it) author Rego policies via the policy-as-code loop. Detailed per-stack commands and rule references live under references/; multi-step runbooks live under workflows/.

When to Use

• Scan Terraform .tf / plan JSON for misconfigurations
• Audit CloudFormation YAML/JSON templates
• Validate Kubernetes manifests (incl. rendered Helm / kustomize)
• Validate Helm charts pre- and post-render
• Scan ARM / Bicep templates for Azure misconfigurations
• Verify CIS benchmark compliance across AWS / Azure / GCP / K8s
• Integrate IaC scanning into PR gates or pre-commit hooks
• Author custom OPA/Rego policies for org-specific controls

Trigger Phrases

• "scan this Terraform / audit my CloudFormation / check Kubernetes manifests"
• "validate Helm chart security" · "IaC security scan" · "infrastructure compliance"
• "write a Rego policy for X" · "add Conftest rule for Y"

When NOT to Use This Skill

• Runtime cloud assessment (live AWS/Azure/GCP accounts, IAM policies in force, runtime resource state) → use exploiting-cloud-platforms.
• Container image CVE scanning, admission control at runtime, cluster live scans → use container-security.
• Secrets discovery in a codebase → use auditing-supply-chain (pair with this skill for IaC files that contain secrets).
• Application source-code SAST → use auditing-code-for-vulnerabilities / sast.
• Pure drift detection vs deployed state — not in scope; use Terraform Cloud / Driftctl / AWS Config.

Decision Tree

What file(s)?
├── .tf / .tf.json / tfplan.json   → workflows/terraform_scan.md
├── CFN .yaml/.json/.template      → workflows/cloudformation_scan.md
├── K8s manifests (Deployment/etc) → workflows/kubernetes_manifest_scan.md
├── Helm chart (Chart.yaml)        → references/helm.md  (render → K8s workflow)
├── ARM / .bicep                   → references/arm_bicep.md
└── Need a custom org rule?        → workflows/policy_as_code_loop.md

If the target mixes types (monorepo), fan out: run every applicable workflow in parallel, then merge findings with iac_type as the disambiguator.

Parallelism Hints

Run concurrently (no shared state, all read-only):

• Checkov + tfsec + Terrascan on the same Terraform dir
• cfn-lint (first, as a gate) → then cfn-nag + Checkov + KICS in parallel
• kubesec + kube-linter + Polaris + Checkov on K8s manifests
• One sub-agent per IaC type when a monorepo contains multiple

Must be sequential:

• terraform init && terraform plan && terraform show -json BEFORE plan-based Checkov scan
• helm template / kustomize build BEFORE manifest scanners
• cfn-lint error gate BEFORE CFN security scanners (malformed templates poison the rest)
• Findings aggregation + dedup AFTER all scanners complete

Sub-Agent Delegation

Spawn sub-agents for:

• One per scanner (Checkov / tfsec / Terrascan / KICS) in large Terraform repos — each owns its own output file, main agent aggregates.
• One per IaC type in monorepos (TF sub-agent, K8s sub-agent, CFN sub-agent).
• Dedicated policy-author sub-agent for workflows/policy_as_code_loop.md — it carries full context on Rego idioms and the PASS/FAIL fixture discipline.
• Dedicated aggregator sub-agent to read all scanner JSON outputs, apply references/severity_mapping.md, and emit the unified report.

Do NOT parallelize across sub-agents when one workflow must gate another (e.g. cfn-lint → cfn-nag).

Reasoning Budget

• Extended thinking ON: writing custom Rego, interpreting cross-tool disagreements (e.g. Checkov CRITICAL + tfsec MEDIUM on the same resource), deciding whether a suppression is legitimate, designing fixture pairs.
• Extended thinking OFF: running scanners, parsing their JSON, applying the severity mapping table, formatting the report, file-system operations.

Multimodal Hooks

• Accept architecture diagrams (PNG / PDF) as context when reasoning about network boundaries and expected exposure — useful to decide whether a 0.0.0.0/0 SG rule is actually the desired public edge.
• If the user pastes a screenshot of a scanner UI / dashboard finding, read the rule ID and resource from the image and route to the matching reference.

Structured Output

All findings MUST conform to schemas/finding.json. Key IaC-specific fields: iac_file, iac_type, resource_type, resource_name, tool, rule_id, cis_benchmark_id, normalized_severity. Dedup on (iac_file, resource_type, resource_name, category) keeping highest normalized severity.

Quick-Start Commands

Minimal first pass per stack — use as a smoke test before invoking a full workflow:

# Terraform
checkov -d . --framework terraform -o json > /tmp/ckv.json
tfsec . --format json                     > /tmp/tfs.json

# CloudFormation (lint gate → security)
cfn-lint templates/*.yaml && checkov -d templates/ --framework cloudformation

# Kubernetes manifests
kube-linter lint ./k8s --format json > /tmp/kl.json
checkov -d ./k8s --framework kubernetes

# Helm — render first
helm template myrel ./chart -f values-prod.yaml | checkov -f - --framework kubernetes

# ARM / Bicep
checkov -d ./arm --framework arm

# Conftest (custom org rules)
conftest test  -p policy/

Triage Cheatsheet

Highest-impact finding families — fix these before anything else:

1. Public network ingress on admin ports (SSH/RDP/DB) — security groups, NSGs, NACLs with 0.0.0.0/0 or ::/0 → sev=critical.
2. Public data stores — S3 public-read, Azure storage allowBlobPublicAccess, RDS/CosmosDB publicly_accessible → sev=critical.
3. Wildcard IAM — Action: "*" with Resource: "*" in AWS IAM / Azure role / GCP IAM binding → sev=critical.
4. Unencrypted at-rest — S3/EBS/RDS/Azure Storage without SSE or CMK; KMS without rotation → sev=high.
5. Privileged / hostPath / hostNetwork pods — container escape / node-level blast radius → sev=high.
6. Missing audit trails — CloudTrail disabled, Azure Activity Log export off, VPC flow logs missing → sev=high.
7. Hardcoded secrets in IaC — re-route to auditing-supply-chain, keep a breadcrumb in this report.

Everything else (tagging, versioning, lifecycle, resource hygiene) queues behind the above.

Workflow Index

| Workflow | File | Use when | |----------|------|----------| | Terraform scan | workflows/terraform_scan.md | Any .tf change or TF repo audit | | CloudFormation scan | workflows/cloudformation_scan.md | CFN templates (lint → security) | | Kubernetes manifest scan | workflows/kubernetes_manifest_scan.md | Raw K8s / rendered Helm / kustomize | | Policy-as-code loop | workflows/policy_as_code_loop.md | Authoring custom OPA/Rego rules |

Examples Index

| File | Purpose | |------|---------| | examples/opa_rego_templates.md | Starter Rego for common org controls (K8s, TF, CFN) | | examples/vulnerable_terraform.tf | Intentionally-misconfigured fixture for scanner / Rego regression tests |

References Index

| File | Contents | |------|----------| | references/terraform.md | Checkov / tfsec / Terrascan commands, misconfig catalog, custom checks | | references/cloudformation.md | Checkov / cfn-lint / cfn-nag / KICS commands + CFN checklist | | references/kubernetes_manifests.md | kubesec / Checkov / Trivy / kube-linter / Polaris + K8s checklist | | references/helm.md | Render-vs-direct scanning, Chart.yaml hygiene, pluto for deprecated APIs | | references/arm_bicep.md | Checkov / KICS / PSRule for Azure + ARM/Bicep checklist | | references/severity_mapping.md | Per-tool → normalized severity table, dedup key, category buckets | | references/ci_cd_integration.md | GitHub Actions / GitLab CI / pre-commit wiring, gate policy guidance | | references/bounty_patterns_2024_2026.md | Post-2023 bounty TTPs (Terraform OIDC AWS trust misconfig, Helm dev/prod parity drift, unauth kube-apiserver exposure, shift-left maturity gaps) |

Tools

| Tool | Purpose | Install | |------|---------|---------| | Checkov | Multi-framework IaC scanner | pip install checkov | | tfsec | Terraform security scanner | brew install tfsec | | Terrascan | Multi-cloud IaC scanner | brew install terrascan | | KICS | Keeping IaC Secure (Checkmarx) | docker pull checkmarx/kics | | kubesec | K8s manifest scoring | brew install kubesec | | kube-linter | K8s rule library | go install golang.stackrox.io/kube-linter/cmd/kube-linter@latest | | Polaris | Opinionated K8s workload checks | brew install fairwinds/tap/polaris | | cfn-lint | CFN schema/intrinsic lint | pip install cfn-lint | | cfn-nag | CFN security scanner | gem install cfn-nag | | Trivy | Config scanning (IaC mode) | brew install trivy | | OPA / Conftest | Policy-as-code | brew install opa conftest | | Regal | Rego linter | brew install regal | | pluto | Deprecated K8s API detection | brew install FairwindsOps/tap/pluto |

Last Validated

2026-04. Minimum versions: Checkov ≥ 3.0, tfsec ≥ 1.28, Terrascan ≥ 1.19, Conftest ≥ 0.50, OPA ≥ 0.62, kube-linter ≥ 0.6, Polaris ≥ 9.0, cfn-lint ≥ 1.0, Trivy ≥ 0.50.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: EvilFreelancer
• Source: EvilFreelancer/secs
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.