What it does. 'Implements automated security scanning for Infrastructure as Code using Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/implementing-infrastructure-as-code-security-scanning/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-infrastructure-as-code-security-scanning, or copy the skill folder into ~/.claude/skills/implementing-infrastructure-as-code-security-scanning/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-infrastructure-as-code-security-scanning/SKILL.md

SKILL.md (verbatim)

name: implementing-infrastructure-as-code-security-scanning
description: 'Implements automated security scanning for Infrastructure as Code using
  Checkov, tfsec, and KICS to detect misconfigurations in Terraform, CloudFormation,
  Kubernetes manifests, and Helm charts, plus policy-based governance and CI/CD
  integration. Use when validating cloud infrastructure before deployment or blocking
  insecure changes (public S3 buckets, open security groups) in pull requests.

  '
domain: cybersecurity
subdomain: devsecops
tags:
- devsecops
- cicd
- iac-security
- checkov
- tfsec
- terraform
- secure-sdlc
version: 1.0.0
author: mahipal
license: Apache-2.0
nist_csf:
- PR.PS-01
- GV.SC-07
- ID.IM-04
- PR.PS-04
mitre_attack:
- T1195
- T1554
- T1059.004
- T1078.004
- T1530

Implementing Infrastructure as Code Security Scanning

When to Use

• When provisioning cloud infrastructure with Terraform, CloudFormation, or Pulumi and needing automated security validation
• When compliance frameworks require evidence of infrastructure configuration review before deployment
• When preventing common cloud misconfigurations like public S3 buckets, open security groups, or unencrypted storage
• When establishing guardrails that block insecure infrastructure changes in pull requests
• When managing multi-cloud environments requiring consistent security policies across AWS, Azure, and GCP

Do not use for scanning application source code (use SAST), for monitoring already-deployed infrastructure drift (use cloud security posture management tools), or for container image vulnerability scanning (use Trivy).

Prerequisites

• Checkov v3.x installed (pip install checkov) or tfsec installed
• Terraform, CloudFormation, or Kubernetes IaC files in the repository
• CI/CD pipeline with access to IaC directories
• Bridgecrew API key (optional, for Checkov platform integration)

Workflow

Step 1: Run Checkov Against Terraform Files

# Scan all Terraform files in a directory
checkov -d ./terraform/ --framework terraform --output cli --output json --output-file-path ./results

# Scan specific file
checkov -f main.tf --output json

# Scan Terraform plan (more accurate for dynamic values)
terraform init && terraform plan -out=tfplan
terraform show -json tfplan > tfplan.json
checkov -f tfplan.json --framework terraform_plan

# Scan with specific checks only
checkov -d ./terraform/ --check CKV_AWS_18,CKV_AWS_19,CKV_AWS_20

# Skip specific checks
checkov -d ./terraform/ --skip-check CKV_AWS_145,CKV2_AWS_6

Step 2: Integrate IaC Scanning into GitHub Actions

# .github/workflows/iac-security.yml
name: IaC Security Scan

on:
  pull_request:
    paths:
      - 'terraform/**'
      - 'cloudformation/**'
      - 'k8s/**'

jobs:
  checkov:
    name: Checkov IaC Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run Checkov
        uses: bridgecrewio/checkov-action@v12
        with:
          directory: terraform/
          framework: terraform
          output_format: cli,sarif
          output_file_path: console,checkov.sarif
          soft_fail: false
          skip_check: CKV_AWS_145

      - name: Upload SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: checkov.sarif
          category: checkov-iac

  tfsec:
    name: tfsec Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run tfsec
        uses: aquasecurity/tfsec-action@v1.0.3
        with:
          working_directory: terraform/
          sarif_file: tfsec.sarif
          soft_fail: false

      - name: Upload SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: tfsec.sarif
          category: tfsec

Step 3: Create Custom Checkov Policies

# custom_checks/s3_versioning.py
from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
from checkov.common.models.enums import CheckResult, CheckCategories


class S3BucketVersioning(BaseResourceCheck):
    def __init__(self):
        name = "Ensure S3 bucket has versioning enabled"
        id = "CKV_CUSTOM_1"
        supported_resources = ["aws_s3_bucket"]
        categories = [CheckCategories.GENERAL_SECURITY]
        super().__init__(name=name, id=id, categories=categories,
                         supported_resources=supported_resources)

    def scan_resource_conf(self, conf):
        versioning = conf.get("versioning", [{}])
        if isinstance(versioning, list) and len(versioning) > 0:
            if versioning[0].get("enabled", [False])[0]:
                return CheckResult.PASSED
        return CheckResult.FAILED


check = S3BucketVersioning()

Step 4: Configure Baseline and Suppressions

# .checkov.yaml
branch: main
compact: true
directory:
  - terraform/
  - cloudformation/
framework:
  - terraform
  - cloudformation
  - kubernetes
output:
  - cli
  - sarif
skip-check:
  - CKV_AWS_145    # S3 default encryption with CMK (using SSE-S3 is acceptable)
  - CKV2_AWS_6     # S3 bucket request logging (handled at CloudTrail level)
soft-fail: false

Step 5: Scan Kubernetes Manifests and Helm Charts

# Scan Kubernetes manifests
checkov -d ./k8s/ --framework kubernetes

# Scan Helm charts (renders templates first)
checkov -d ./charts/myapp/ --framework helm

# Scan with KICS (Keeping Infrastructure as Code Secure)
docker run -v $(pwd)/k8s:/path checkmarx/kics:latest scan \
  --path /path \
  --output-path /path/results \
  --type Kubernetes \
  --report-formats json,sarif

Key Concepts

Term	Definition
IaC Scanning	Automated analysis of infrastructure code templates to detect security misconfigurations before deployment
Policy as Code	Security policies defined as executable code that can be version-controlled, tested, and enforced automatically
CKV Check ID	Checkov's unique identifier for each security check (e.g., CKV_AWS_18 for S3 public access)
Terraform Plan Scanning	Scanning the resolved Terraform plan JSON which includes computed values and module expansions
Graph-based Scanning	Checkov's ability to analyze relationships between resources, not just individual resource configs
Drift Detection	Identifying differences between IaC definitions and actual deployed infrastructure state
Custom Policy	Organization-specific security checks authored in Python or YAML to enforce internal standards

Tools & Systems

• Checkov: Open-source IaC scanner by Bridgecrew with 2500+ built-in policies covering major cloud providers
• tfsec: Terraform-focused static analysis tool by Aqua Security with deep HCL understanding
• KICS: Open-source IaC scanner by Checkmarx supporting 15+ IaC frameworks
• Terrascan: IaC scanner with OPA Rego policy support for custom policy authoring
• Snyk IaC: Commercial IaC scanner integrated with the Snyk platform

Common Scenarios

Scenario: Preventing Public S3 Buckets in Terraform

Context: A development team repeatedly creates S3 buckets without proper access controls. A recent incident exposed customer data through a public bucket.

Approach:

1. Enable Checkov in the CI/CD pipeline for all Terraform changes
2. Enforce CKV_AWS_18 (no public read ACL), CKV_AWS_19 (encryption), CKV_AWS_20 (no public access block disabled)
3. Create a custom policy requiring the aws_s3_bucket_public_access_block resource for every S3 bucket
4. Set soft_fail: false to block PR merges when S3 security checks fail
5. Provide Terraform modules with security defaults that teams can reuse

Pitfalls: Scanning only .tf files misses dynamically computed values. Use Terraform plan scanning for higher accuracy. Checkov's resource-relationship checks (CKV2 prefix) require graph analysis mode.

Output Format

IaC Security Scan Report
==========================
Framework: Terraform
Directory: terraform/
Scan Date: 2026-02-23

Checkov Results:
  Passed: 187
  Failed: 12
  Skipped: 3
  Unknown: 0

FAILED CHECKS:
  CKV_AWS_18  [HIGH]   S3 Bucket has public read ACL
              Resource: aws_s3_bucket.data_lake
              File:     terraform/storage.tf:15-28

  CKV_AWS_24  [HIGH]   CloudWatch log group not encrypted
              Resource: aws_cloudwatch_log_group.app
              File:     terraform/monitoring.tf:3-8

  CKV_AWS_79  [MEDIUM] Instance metadata service v1 enabled
              Resource: aws_instance.web
              File:     terraform/compute.tf:12-30

QUALITY GATE: FAILED (2 HIGH severity findings)

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

IaC Security Scanning Templates

Checkov Configuration File

# .checkov.yaml
branch: main
compact: true
directory:
  - terraform/
  - cloudformation/
  - k8s/
framework:
  - terraform
  - cloudformation
  - kubernetes
output:
  - cli
  - sarif
skip-check:
  - CKV_AWS_145   # CMK encryption for S3 (SSE-S3 acceptable)
  - CKV2_AWS_6    # S3 request logging (CloudTrail covers this)
soft-fail: false

GitHub Actions Pipeline

# .github/workflows/iac-security.yml
name: IaC Security

on:
  pull_request:
    paths: ['terraform/**', 'k8s/**', 'cloudformation/**']

jobs:
  checkov:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: bridgecrewio/checkov-action@v12
        with:
          directory: terraform/
          framework: terraform
          output_format: cli,sarif
          output_file_path: console,checkov.sarif
          soft_fail: false
      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: checkov.sarif

Secure Terraform Module Template

# modules/secure-s3-bucket/main.tf
resource "aws_s3_bucket" "this" {
  bucket = var.bucket_name
  tags   = var.tags
}

resource "aws_s3_bucket_versioning" "this" {
  bucket = aws_s3_bucket.this.id
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
  bucket = aws_s3_bucket.this.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "aws:kms"
      kms_master_key_id = var.kms_key_id
    }
    bucket_key_enabled = true
  }
}

resource "aws_s3_bucket_public_access_block" "this" {
  bucket = aws_s3_bucket.this.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_s3_bucket_logging" "this" {
  bucket        = aws_s3_bucket.this.id
  target_bucket = var.logging_bucket
  target_prefix = "s3-access-logs/${var.bucket_name}/"
}

references/api-reference.md (verbatim)

API Reference: Implementing Infrastructure as Code Security Scanning

Checkov CLI

# Scan Terraform directory
checkov -d /path/to/tf --framework terraform --output json
# Scan specific file
checkov -f main.tf
# Scan CloudFormation
checkov -d . --framework cloudformation
# Scan Kubernetes manifests
checkov -d . --framework kubernetes
# Skip specific checks
checkov -d . --skip-check CKV_AWS_18,CKV_AWS_21

tfsec CLI

# Scan directory
tfsec /path/to/tf --format json
# Exclude specific rules
tfsec . --exclude aws-s3-enable-bucket-logging
# Minimum severity
tfsec . --minimum-severity HIGH

Common IaC Security Checks

Check ID	Description	Severity
CKV_AWS_18	S3 bucket logging	MEDIUM
CKV_AWS_19	S3 bucket encryption	HIGH
CKV_AWS_23	Security group open to 0.0.0.0/0	HIGH
CKV_AWS_41	RDS encryption	HIGH
CKV_AWS_145	KMS key rotation	MEDIUM
CKV_K8S_1	Pod privileged container	CRITICAL

GitHub Actions Integration

- uses: bridgecrewio/checkov-action@master
  with:
    directory: .
    framework: terraform
    output_format: sarif
    soft_fail: false

References

• Checkov: https://www.checkov.io/
• tfsec: https://aquasecurity.github.io/tfsec/
• KICS: https://kics.io/
• Bridgecrew: https://www.bridgecrew.io/

references/standards.md (verbatim)

Standards Reference: IaC Security Scanning

CIS Cloud Benchmarks

CIS AWS Foundations Benchmark v3.0

• Maps directly to Checkov CKV_AWS_* checks
• Covers IAM, logging, monitoring, networking, and storage security
• Automated scanning validates 100+ benchmark controls

CIS Azure Foundations Benchmark v2.1

• Maps to Checkov CKV_AZURE_* checks
• Covers identity, security center, storage, database, and network controls

CIS GCP Foundations Benchmark v2.0

• Maps to Checkov CKV_GCP_* checks
• Covers IAM, logging, networking, VM, storage, and database controls

NIST SP 800-53 Mapping

NIST Control	IaC Check	Checkov ID
AC-3 Access Enforcement	S3 bucket public access	CKV_AWS_18, CKV_AWS_20
AU-2 Audit Events	CloudTrail enabled	CKV_AWS_35
SC-8 Transmission Confidentiality	HTTPS/TLS enforcement	CKV_AWS_2
SC-28 Protection at Rest	Encryption at rest	CKV_AWS_19, CKV_AWS_17
SI-4 System Monitoring	CloudWatch/logging	CKV_AWS_24, CKV_AWS_66

OWASP SAMM - Secure Architecture

Security Architecture Level 2

• Validate infrastructure configurations against security standards before deployment
• Use automated tools to enforce architecture security requirements

Security Architecture Level 3

• Custom policies encode organization-specific architecture requirements
• Continuous validation prevents configuration drift from approved patterns

NIST SSDF (SP 800-218)

PO.1: Define Security Requirements

• IaC security policies translate security requirements into enforceable checks
• Custom policies capture organization-specific requirements

PW.5: Configure Software Securely

• PW.5.1: Configure software to have secure settings by default
• IaC scanning enforces secure defaults in infrastructure provisioning

references/workflows.md (verbatim)

Workflow Reference: IaC Security Scanning

IaC Scanning Pipeline

Terraform/IaC Code Change
       │
       ▼
┌──────────────────┐
│ PR Created       │
└──────┬───────────┘
       │
       ├──────────────────────┐
       ▼                      ▼
┌──────────────┐    ┌──────────────┐
│ Checkov      │    │ tfsec        │
│ (2500+ rules)│    │ (Terraform)  │
└──────┬───────┘    └──────┬───────┘
       │                    │
       └──────────┬─────────┘
                  ▼
       ┌──────────────────┐
       │ SARIF Upload     │
       │ to GitHub        │
       └──────┬───────────┘
              │
              ▼
       ┌──────────────────┐
       │ Quality Gate     │
       │ (Block on HIGH+) │
       └──────┬───────────┘
              │
    ┌─────────┴──────────┐
    ▼                    ▼
 PASS                  FAIL
 terraform apply      Block merge
 permitted            + Fix required

Checkov Command Reference

Command	Purpose
checkov -d ./terraform/	Scan directory
checkov -f main.tf	Scan single file
checkov -f tfplan.json --framework terraform_plan	Scan Terraform plan
checkov --list	List all available checks
checkov -d . --check CKV_AWS_18	Run specific check
checkov -d . --skip-check CKV_AWS_145	Skip specific check
checkov -d . --bc-api-key KEY	Upload to Bridgecrew
checkov -d . --create-baseline	Create baseline file
checkov -d . --baseline BASELINE	Scan against baseline
checkov -d . --external-checks-dir ./custom/	Use custom checks
checkov -d . --compact	Compact output
checkov -d . --output sarif	SARIF format output

Common Misconfigurations by Cloud Provider

AWS Top 10 IaC Misconfigurations

1. S3 bucket public access enabled (CKV_AWS_18, CKV_AWS_20)
2. Security group with open ingress 0.0.0.0/0 (CKV_AWS_23)
3. RDS instance not encrypted (CKV_AWS_16)
4. CloudTrail not enabled (CKV_AWS_35)
5. EBS volume not encrypted (CKV_AWS_3)
6. IAM policy with wildcard actions (CKV_AWS_1)
7. ALB not using HTTPS (CKV_AWS_2)
8. CloudWatch logs not encrypted (CKV_AWS_24)
9. IMDSv2 not required (CKV_AWS_79)
10. VPC flow logs not enabled (CKV_AWS_9)

Kubernetes Top Misconfigurations

1. Container running as root (CKV_K8S_6)
2. Privileged container (CKV_K8S_16)
3. No resource limits (CKV_K8S_11, CKV_K8S_13)
4. No readiness/liveness probes (CKV_K8S_9)
5. hostNetwork enabled (CKV_K8S_19)

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.