Infrastructure as Code Security: Scanning Terraform and CloudFormation

Infrastructure as code changed cloud security in a way most teams have not fully cashed in. When your buckets, security groups, and IAM roles are defined in Terraform or CloudFormation, a misconfiguration is no longer a click someone made in a console at 2am — it is a line in a file, in version control, reviewable before it ever becomes real. IaC scanning is how you catch the open bucket while it is still a pull request.

Terraform, AWS CloudFormation, Azure Bicep, and their kin let you declare infrastructure as text and apply it repeatably. That is an operational win, but the security win is bigger and often missed: the same properties that make code reviewable — it is static, versioned, and diffable — make its security posture analysable before deployment. A public bucket or a wildcard IAM policy is visible in the definition, and you can reject it in CI rather than discover it in a scan of production weeks later.

Shifting the misconfiguration left

The whole point is timing. Cloud posture tools find misconfigurations after they exist and are potentially exploitable. IaC scanning finds them before — in the pull request, when fixing them is a one-line change and no data has been exposed. The two are complementary: IaC scanning catches what is defined in code, and posture management catches drift and anything created outside the pipeline. Neither replaces the other.

What the scanners look for

• Public exposure. Buckets and blobs granting public access, security groups opening sensitive ports to 0.0.0.0/0, databases with public endpoints.
• IAM over-reach. Wildcard actions and resources, over-broad managed policies, and trust relationships that trust too widely.
• Missing encryption. Volumes, storage, and databases declared without encryption at rest, or without enforced TLS in transit.
• Logging and monitoring gaps. Trails, audit logs, or flow logs that the template never enables.
• Hard-coded secrets. Credentials and keys committed straight into the template or its variables — caught before they reach the repo's history.

A healthy ecosystem of tools does this: open-source scanners such as Checkov, tfsec, Terrascan, and KICS, alongside the checks built into cloud-native and commercial platforms. They evaluate the definitions against a policy set and fail the build when something crosses a line — the same policy-as-code idea CSPM applies to running resources, moved earlier in the lifecycle.

Making it part of the pipeline

• Scan on every pull request. Run the checks automatically and make high-severity findings block the merge, not just annotate it.
• Write custom policies for your standards. Encode organisation-specific rules — mandatory tags, approved regions, required encryption — as code alongside the built-ins.
• Fail the build, but tune the noise. Calibrate severities so real issues stop a deploy and cosmetic ones do not train people to ignore the scanner.
• Pair it with runtime posture management. IaC scanning cannot see resources created by hand or drift after apply — CSPM covers the gap.

IaC scanning is the rare security control that makes fixing things cheaper rather than slower, by catching misconfigurations at the one moment they are trivial to change. But it only governs the infrastructure that actually flows through your pipeline. The bucket someone clicked into existence in the console, the account outside your Terraform — those it never sees, which is why code scanning and estate discovery are two halves of the same job: you can't defend what you haven't discovered.