implementing-infrastructure-as-code-security-scanning

# Implementing Infrastructure as Code Security Scanning ## When to Use - When provisioning cloud infrastructure with Terraform, CloudFormation, or Pulumi and needing automated security validation - When compliance frameworks require evidence of infrastructure configuration review before deployment - When preventing common cloud misconfigurations like public S3 buckets, open security groups, or unencrypted storage - When establishing guardrails that block insecure infrastructure changes in pull requests - When managing multi-cloud environments requiring consistent security policies across AWS, Azure, and GCP **Do not use** for scanning application source code (use SAST), for monitoring already-deployed infrastructure drift (use cloud security posture management tools), or for container image vulnerability scanning (use Trivy). ## Prerequisites - Checkov v3.x installed (`pip install checkov`) or tfsec installed - Terraform, CloudFormation, or Kubernetes IaC files in the repository - CI/CD pipeline with access to IaC directories - Bridgecrew API key (optional, for Checkov platform integration) ## Workflow ### Step 1: Run Checkov Against Terraform Files ```bash # Scan all Terraform files in a directory checkov -d ./terraform/ --framework terraform --output cli --output json --output-file-path ./results # Scan specific file checkov -f main.tf --output json # Scan Terraform plan (more accurate for dynamic values) terraform init && terraform plan -out=tfplan terraform show...