iac-scanner
Scans Infrastructure as Code for security misconfigurations. Wraps tfsec for Terraform and Checkov for multi-cloud IaC. Use when user asks to "scan Terraform", "IaC security", "infrastructure scan", "tfsec", "checkov", "Terraformセキュリティ", "インフラスキャン".
When & Why to Use This Skill
The IaC Scanner is a comprehensive security auditing tool for Claude that automates the detection of misconfigurations in Infrastructure as Code (IaC). By integrating industry-standard scanners like tfsec and Checkov, it identifies critical vulnerabilities in Terraform, Kubernetes, CloudFormation, and ARM templates, helping developers maintain cloud compliance and prevent security breaches before deployment.
Use Cases
- Pre-deployment Security Audits: Automatically scan Terraform and Kubernetes configurations to identify high-risk issues like unencrypted S3 buckets or open security groups before they are provisioned.
- Multi-Cloud Compliance Validation: Use Checkov integration to ensure infrastructure templates for AWS, Azure, and GCP adhere to security best practices and organizational policies.
- Automated Code Reviews: Enhance the DevSecOps workflow by scanning IaC files for hardcoded secrets, overly permissive IAM roles, and missing logging configurations.
- Rapid Vulnerability Remediation: Generate detailed security reports that pinpoint the exact line of code causing a risk and provide actionable resolution steps to fix misconfigurations quickly.
| name | iac-scanner |
|---|---|
| description | Scans Infrastructure as Code for security misconfigurations. Wraps tfsec for Terraform and Checkov for multi-cloud IaC. Use when user asks to "scan Terraform", "IaC security", "infrastructure scan", "tfsec", "checkov", "Terraformセキュリティ", "インフラスキャン". |
IaC Scanner
Wrapper for tfsec and Checkov to scan Infrastructure as Code.
Prerequisites
# tfsec (Terraform focused)
brew install tfsec
# or
go install github.com/aquasecurity/tfsec/cmd/tfsec@latest
# Checkov (multi-cloud)
pip install checkov
# or
brew install checkov
Usage
# Scan with auto-detection
npx iac-scanner .
# Force specific scanner
npx iac-scanner . --scanner tfsec
npx iac-scanner . --scanner checkov
# JSON output
npx iac-scanner . --json
# Check available scanners
npx iac-scanner --check
# Scan specific framework
npx iac-scanner . --framework terraform
npx iac-scanner . --framework kubernetes
npx iac-scanner . --framework cloudformation
Supported Frameworks
| Scanner | Frameworks |
|---|---|
| tfsec | Terraform |
| Checkov | Terraform, CloudFormation, Kubernetes, ARM, Serverless, Helm |
Output Format
{
"tool": "tfsec",
"scanPath": ".",
"scanDate": "2024-01-15T10:30:00Z",
"findings": [
{
"id": "aws-s3-enable-bucket-encryption",
"severity": "high",
"message": "Bucket does not have encryption enabled",
"resource": "aws_s3_bucket.data",
"file": "main.tf",
"line": 15,
"resolution": "Enable bucket encryption"
}
],
"summary": {
"total": 5,
"critical": 1,
"high": 2,
"medium": 1,
"low": 1
}
}
Common Misconfigurations
| Category | Example |
|---|---|
| Encryption | S3 bucket without encryption |
| Access Control | Public S3 bucket, open security groups |
| Logging | Missing CloudTrail, no access logs |
| Network | VPC without flow logs, open CIDR |
| IAM | Overly permissive policies, wildcard actions |
| Secrets | Hardcoded credentials in config |
Exit Codes
0: No issues found1: Issues detected2: Tool not installed or error