sc-iac

SC: Infrastructure-as-Code Security

Purpose

Scans Infrastructure-as-Code files for security misconfigurations including Dockerfile anti-patterns, Kubernetes privilege escalation, Terraform resource exposure, and GitHub Actions injection vulnerabilities. Covers the full deployment pipeline from build to runtime.

Activation

Called by sc-orchestrator during Phase 2 when IaC files are detected (Dockerfile, *.tf, k8s manifests, workflow files).

Phase 1: Discovery

File Patterns

**/Dockerfile*, **/docker-compose*, **/*.tf, **/*.tfvars,
**/k8s/*, **/kubernetes/*, **/helm/*, **/*.yaml, **/*.yml,
**/.github/workflows/*, **/.gitlab-ci.yml, **/Jenkinsfile

Dockerfile Checks

# VULNERABLE: Running as root
FROM node:18
COPY . /app
CMD ["node", "app.js"]  # Runs as root!

# SAFE: Non-root user
FROM node:18
RUN addgroup --system app && adduser --system --ingroup app app
COPY --chown=app:app . /app
USER app
CMD ["node", "app.js"]

• Running as root (missing USER directive)
• Secrets in build args (ARG PASSWORD=secret)
• Using latest tag for base images
• ADD instead of COPY (ADD can auto-extract and fetch URLs)
• Exposed unnecessary ports

Kubernetes Checks

# VULNERABLE: Privileged container
spec:
  containers:
  - name: app
    securityContext:
      privileged: true       # Full host access!
      runAsRoot: true
    volumeMounts:
    - mountPath: /host
      name: host-root
  volumes:
  - name: host-root
    hostPath:
      path: /                # Mounting host filesystem!

• Privileged containers, hostPID, hostNetwork
• hostPath volume mounts
• Missing network policies
• Default service account with broad permissions
• Missing resource limits
• Missing securityContext (readOnlyRootFilesystem, runAsNonRoot)

Terraform Checks

# VULNERABLE: Public S3 bucket
resource "aws_s3_bucket" "data" {
  bucket = "my-data-bucket"
  acl    = "public-read"  # Publicly accessible!
}

# VULNERABLE: Overly permissive IAM
resource "aws_iam_policy" "admin" {
  policy = jsonencode({
    Statement = [{
      Effect   = "Allow"
      Action   = "*"        # Full admin access!
      Resource = "*"
    }]
  })
}