IaC Security Scanner Skill

IaC Security Scanner

Scan infrastructure code for security misconfigurations using 790 policies extracted from Terrascan.

Capabilities

Terraform (HCL2): AWS, Azure, GCP resources
Kubernetes: Pods, Deployments, Services, RBAC
CloudFormation: AWS resources (JSON/YAML)
Dockerfiles: Image security best practices
Compliance Mapping: NIST 800-53 controls
- HCL Normalization Helper: scripts/normalize_hcl.py uses python-hcl2

Prerequisites (Optional)

For HCL normalization: pip install python-hcl2

Scan Workflow

1. Identify IaC Type and Provider

Determine from file extensions and content:

.tf → Terraform HCL
.yaml/.yml with apiVersion → Kubernetes
.yaml/.yml or .json with AWSTemplateFormatVersion → CloudFormation
Dockerfile → Docker
.json with $schema.*deploymentTemplate → ARM

2. Load Relevant Reference Files

Based on detected provider, load policies from:

AWS: references/aws/README.md then specific resource files
Azure: references/azure/README.md
GCP: references/gcp/README.md
K8s: references/k8s/README.md
Docker: references/docker/README.md

For control mapping: references/nist-mapping.md

3. Extract Resources

Parse the IaC to identify:

Resource types (e.g., aws_s3_bucket, kubernetes_pod)
Resource configurations
Resource relationships

4. Apply Security Checks

For each resource:

Load the corresponding policy file (e.g., references/aws/aws_s3_bucket.md)
Check each policy's conditions against the resource config
Record violations with severity and remediation

5. Generate Report

Output format:

## Security Scan Results

**File**: main.tf
**IaC Type**: Terraform (AWS)
**Resources Scanned**: 12
**Findings**: 5 (🔴 2 HIGH, 🟡 2 MEDIUM, 🟢 1 LOW)

### 🔴 HIGH: AC_AWS_0132 - S3 bucket missing public access block
- **Resource**: aws_s3_bucket.data_lake (line 45)
- **Category**: Network Security
- **NIST Controls**: SC-7, AC-3
- **Issue**: No `aws_s3_bucket_public_access_block` resource found
- **Remediation**:
  ```hcl
  resource "aws_s3_bucket_public_access_block" "data_lake" {
    bucket                  = aws_s3_bucket.data_lake.id
    block_public_acls       = true
    block_public_policy     = true
    ignore_public_acls      = true
    restrict_public_buckets = true
  }


## Reference File Format

Each resource policy file contains:
- Policy ID and name
- Severity level (HIGH/MEDIUM/LOW)
- Category
- Description of the security issue
- What to check
- NIST 800-53 control mapping (where applicable)

## Severity Definitions

- 🔴 **HIGH**: Immediate security risk, public exposure, data breach potential
- 🟡 **MEDIUM**: Security weakness, defense-in-depth gap, compliance issue
- 🟢 **LOW**: Best practice deviation, hardening recommendation

## Common Scan Scenarios

### Full Repository Scan

Scan all `.tf` files recursively, aggregate findings by severity.

### Pre-Commit Check

Quick scan of staged files, fail on HIGH severity.

### Compliance Audit

Scan with NIST control mapping, group findings by control family.

Agent Skills: IaC Security Scanner

Install this agent skill to your local

Skill Files