iac-security-scanner

IaC Security Scanner

Scan infrastructure code for security misconfigurations using 790 policies extracted from Terrascan.

Capabilities

• Terraform (HCL2): AWS, Azure, GCP resources
• Kubernetes: Pods, Deployments, Services, RBAC
• CloudFormation: AWS resources (JSON/YAML)
• Dockerfiles: Image security best practices
• Compliance Mapping: NIST 800-53 controls
  • HCL Normalization Helper: scripts/normalize_hcl.py uses python-hcl2

Prerequisites (Optional)

• For HCL normalization: pip install python-hcl2

Scan Workflow

1. Identify IaC Type and Provider

Determine from file extensions and content:

• .tf → Terraform HCL
• .yaml/.yml with apiVersion → Kubernetes
• .yaml/.yml or .json with AWSTemplateFormatVersion → CloudFormation
• Dockerfile → Docker
• .json with $schema.*deploymentTemplate → ARM

2. Load Relevant Reference Files

Based on detected provider, load policies from:

• AWS: references/aws/README.md then specific resource files
• Azure: references/azure/README.md
• GCP: references/gcp/README.md
• K8s: references/k8s/README.md
• Docker: references/docker/README.md

For control mapping: references/nist-mapping.md

3. Extract Resources

Parse the IaC to identify:

• Resource types (e.g., aws_s3_bucket, kubernetes_pod)
• Resource configurations
• Resource relationships

4. Apply Security Checks

For each resource:

1. Load the corresponding policy file (e.g., references/aws/aws_s3_bucket.md)
2. Check each policy's conditions against the resource config
3. Record violations with severity and remediation

5. Generate Report

Output format:

## Security Scan Results

**File**: main.tf
**IaC Type**: Terraform (AWS)
**Resources Scanned**: 12
**Findings**: 5 (🔴 2 HIGH, 🟡 2 MEDIUM, 🟢 1 LOW)

### 🔴 HIGH: AC_AWS_0132 - S3 bucket missing public access block
- **Resource**: aws_s3_bucket.data_lake (line 45)
- **Category**: Network Security
- **NIST Controls**: SC-7, AC-3
- **Issue**: No `aws_s3_bucket_public_access_block` resource found
- **Remediation**:
  ```hcl
  resource "aws_s3_bucket_public_access_block" "data_lake" {
    bucket                  = aws_s3_bucket.data_lake.id
    block_public_acls       = true
    block_public_policy     = true
    ignore_public_acls      = true
    restrict_public_buckets = true
  }