How do I set up an infrastructure-as-code security scanner for Terraform and cloud templates in our DevOps pipeline?

Here’s a practical way to set up an infrastructure-as-code (IaC) security scanner for Terraform and cloud templates in a DevOps pipeline.

1) Pick a scanner

Choose a tool that supports the formats you use:

• Terraform: tfsec, checkov, terrascan, trivy config
• Cloud templates:
  • CloudFormation: checkov, cfn-lint, terrascan
  • ARM/Bicep: checkov, terrascan, tfsec is not usually for these
  • Kubernetes manifests/Helm: checkov, terrascan, trivy config

Good all-around options:

• Checkov: broad support, easy CI integration
• Trivy config: simple, fast, multi-format
• Terrascan: policy-focused, multi-cloud

If you want one tool to start with, Checkov is a common choice.

---

2) Decide where it runs in the pipeline

Run the scanner:

• On pull requests: block merges on high/critical issues
• On main branch: enforce a second gate before deploy
• Before terraform apply / deployment: prevent risky changes from reaching cloud

Typical stages:

1. format / validate
2. scan IaC
3. plan
4. review plan / optional scan of rendered plan
5. apply only if checks pass

Best practice: scan both:

• Source IaC files (.tf, .yaml, .json, .bicep)
• Terraform plan output if your tool supports it, because that catches some dynamic values

---

3) Add the scanner to your repo

Example with Checkov:

pip install checkov
checkov -d .

For Terraform-only:

checkov -d path/to/terraform

For specific frameworks:

checkov -d . --framework terraform,cloudformation,arm,helm,kubernetes

---

4) Configure severity and failure behavior

Set thresholds so your pipeline fails only on the issues you care about.

Example:

checkov -d . --soft-fail false --check MEDIUM,HIGH,CRITICAL

Or use skip rules sparingly:

checkov -d . --skip-check CKV_AWS_20

Best practice:

• Fail on HIGH/CRITICAL
• Warn on MEDIUM
• Require documented exceptions for skips

---

5) Integrate into CI/CD

GitHub Actions example

name: IaC Security Scan

on:
  pull_request:
  push:
    branches: [main]

jobs:
  checkov:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install Checkov
        run: pip install checkov

      - name: Run IaC scan
        run: checkov -d . --framework terraform,cloudformation,arm,kubernetes,helm

Azure DevOps example

trigger:
- main

pr:
- '*'

pool:
  vmImage: 'ubuntu-latest'

steps:
- checkout: self

- task: UsePythonVersion@0
  inputs:
    versionSpec: '3.11'

- script: |
    pip install checkov
    checkov -d . --framework terraform,cloudformation,arm,kubernetes,helm
  displayName: 'Run IaC security scan'

---

6) Scan Terraform plans too

Source scanning is great, but Terraform plans can reveal:

• actual resource counts
• computed attributes
• drift between code and intent

Example workflow:

terraform init
terraform plan -out tfplan
terraform show -json tfplan > tfplan.json
checkov -f tfplan.json

This is especially useful when resources are generated dynamically.

---

7) Make results visible

Don’t just fail the build—publish findings where developers can act on them:

• CI job logs
• Pull request comments
• SARIF output to code scanning tools
• Dashboards in Security Hub / DefectDojo / similar

Checkov can output SARIF:

checkov -d . -o sarif > results.sarif

Then upload to your platform’s code scanning feature.

---

8) Reduce false positives and noise

To keep adoption high:

• Start in report-only mode
• Triage and baseline existing findings
• Suppress only with justification
• Use custom policies for your standards

For Checkov, you can:

• create .checkov.yml
• use inline suppressions with comments
• write custom checks if needed

---

9) Add policy-as-code for organization rules

Scanner rules are generic; policy-as-code lets you enforce company-specific requirements:

• encryption required
• no public S3 buckets
• approved regions only
• mandatory tags
• restricted instance types

Tools:

• OPA/Conftest
• Checkov custom policies
• Terrascan policies

This is useful if you need compliance controls beyond the default scanner rules.

---

10) Suggested rollout plan

A practical rollout:

1. Run scans in non-blocking mode
2. Fix critical/high issues
3. Add blocking on PRs
4. Scan Terraform plans
5. Add organization-specific policies
6. Report findings to central security tooling

---

Recommended starter setup

If you want something simple and effective:

• Use Checkov
• Run on every PR and main branch
• Scan:
  • Terraform source
  • CloudFormation/ARM/Bicep/Kubernetes if applicable
  • Terraform plan JSON
• Fail the pipeline on high/critical findings
• Publish SARIF or PR annotations
• Add a small baseline to avoid overwhelming the team initially

If you want, I can also give you:

1. a ready-to-use GitHub Actions, Azure DevOps, or GitLab CI pipeline example, or
2. a comparison of Checkov vs tfsec vs Terrascan vs Trivy for your stack.