IaC Scanning: Concepts, Process, and Tools

What is IaC scanning?

Infrastructure as code (IaC) scanning is the process of analyzing the scripts that automatically provision and configure infrastructure. Unlike traditional code scanning, which focuses on application code, IaC scanning targets the specific syntax and structures used in declaring cloud environments. It has become a crucial tool for maintaining secure and efficient cloud operations.

IaC scanning preemptively identifies misconfigurations and compliance issues before they can be deployed. In the realm of continuous integration and continuous deployment (CI/CD), IaC scans act as a vital checkpoint, both ensuring that infrastructure deployments are secure by design and also facilitating rapid and safe iterations of infrastructure changes.

In this article, we'll navigate the complexities of IaC security scanning, taking a closer look at its significance and the scanning process. We’ll also review fundamental concepts, explore open-source IaC scanning tools, and provide insights on how these tools can bolster your infrastructure's security posture.

Container Security Buyer’s Guide

In this guide, we’ll talk about what’s driving the adoption of cloud-native application development, why it can increase risk, and why container security is needed to close the security gaps it can introduce.

Download now

Key concepts in IaC scanning

Let's start by looking at two foundational elements that make IaC code scanning an indispensable tool for modern infrastructure management:

• Policy as code: Policy as code (PaC) allows teams to explicitly state and manage their infrastructure's operational and security policies within codebases. In IaC scanning, PaC is utilized to automatically validate and enforce compliance with these policies, ensuring that the provisioned infrastructure aligns with organizational and regulatory standards.

• Security and compliance posture: IaC scanning directly impacts an organization's security and compliance posture by systematically detecting and fixing potential security threats and compliance infractions within the IaC scripts. In short, this proactive measure secures the infrastructure and embeds compliance into the foundation of the infrastructure's code.

The following section will explore the IaC scanning process and demonstrate how it fits within the development life cycle.

The IaC scanning process

There are six systematic stages of IaC scanning, each an integral part of securing and optimizing cloud infrastructure:

Open-source IaC scanning tools and solutions

Choosing an open-source IaC scanning tool depends on your organization’s unique infrastructure. This section focuses on several leading open-source IaC scanning tools, providing the insights you need to make the right choice for your business.

Terrascan

Terrascan is a comprehensive IaC scanning tool that can preemptively identify security issues in Terraform templates. What sets it apart is its extensive policy library, which aligns with the CIS Benchmarks, making it a formidable tool for ensuring compliance.

The installation process is straightforward, and Terrascan is frequently utilized in automated pipelines for detecting instances of policy violations. The scan results are easy to understand, detailing violations like overly permissive S3 bucket access with high severity:

$ terrascan scan
By default Terrascan will output its findings in human friendly format:
Violation Details -

  Description    :	S3 bucket Access is allowed to all AWS Account Users.
  File           :	modules/storage/main.tf
  Line           :	124
  Severity       :	HIGH
...

Checkov

Checkov's latest iteration boasts a graph-based scanning engine, representing a significant leap forward in performance and accuracy. With its new engine, Checkov can efficiently resolve complex dependencies within Terraform and analyze Dockerfile configurations, providing a holistic approach to IaC scanning.

Once you install Checkov from PyPI and scan a directory containing Terraform plan files, the output will clearly display the compliance status for each check, allowing you to identify compliant as well as non-compliant configurations:

KICS

KICS is a versatile scanner capable of handling various IaC formats. Its ease of integration with CI/CD pipelines makes it a developer-friendly tool that doesn't interrupt the development process while still maintaining a high security standard.

KICS offers the convenience of scanning both directories and individual files using Docker:

$ docker run -t -v {path_to_host_folder_to_scan}:/path checkmarx/kics:latest scan -p /path -o "/path/"
$ docker run -t -v {path_to_host_folder}:/path checkmarx/kics:latest scan -p /path/{filename}.{extension} -o "/path/"

It also provides developer-friendly reports by showing the source of the vulnerabilities:

tfsec

With a focus on Terraform, tfsec is a static analysis tool that is community driven. Its unique selling point is the depth of its security checks, which are regularly updated by the community, ensuring that the tool stays on the cutting edge of security best practices.

The tfsec scanner can be run on your system or as a Docker container, scanning a specified directory for issues:

$ tfsec . 
$ docker run --rm -it -v "$(pwd):/src" aquasec/tfsec /src

The exit status will help you determine if there were any problems found during the scan:

TFLint

As a linter for Terraform, TFLint assists developers in catching errors early in the development cycle. It emphasizes adherence to coding standards and policy compliance, which is critical for maintaining a high-quality codebase.

TFLint can be installed on different platforms using a bash script, Homebrew, or Docker, and it's used to enforce best practices and find errors:

$ docker run --rm -v $(pwd):/data -t ghcr.io/terraform-linters/tflint

TFLint is known for its pluggable architecture, where each feature is provided by plugins, making it highly customizable and adaptable to various needs:

As we’ve seen, integrating open-source tools into your CI/CD pipeline can secure your infrastructure by catching potential issues early in the development cycle. The ease of use and thorough documentation provided by these tools make them accessible to developers and security professionals, fostering a shift-left approach within your organization.

Wiz's approach to IaC scanning

Wiz provides a comprehensive IaC scanning solution that can help you identify and remediate security vulnerabilities and compliance issues in your infrastructure code. Wiz's IaC scanner can scan a variety of IaC formats, including Terraform, AWS CloudFormation, Azure Resource Manager templates, and Kubernetes manifests. Wiz also provides a variety of features to help you manage your IaC security posture, including:

• Policy enforcement: Wiz can enforce your security policies by automatically flagging code that violates your policies.

• Vulnerability scanning: Wiz can scan your code for known vulnerabilities and provide you with remediation guidance.

• Compliance checking: Wiz can check your code for compliance with industry standards, such as PCI DSS and SOC 2.

Wiz's IaC scanner detects vulnerabilities, secrets, and misconfigurations in IaC templates, container images, and VM images, bolstering security from the earliest stages of development. By providing a single policy across all cloud environments and code, Wiz unites developers and security teams, eliminating silos and ensuring a harmonized approach to cloud security.

With Wiz, you can secure infrastructure from source to production, learn from runtime, and enforce code with unprecedented efficiency and accuracy. See Wiz in action for yourself: Schedule a demo today.