Infrastructure as Code (IaC) scanning

Catch insecure cloud configuration in Terraform, Kubernetes, CloudFormation and Dockerfiles.

Overview

The IaC engine reads your infrastructure-as-code and flags insecure settings before they are ever deployed — public storage buckets, root containers, open security groups and more.

Fixing misconfiguration at the code stage is far cheaper than remediating it in a running cloud environment.

How it works

SecNxt applies a misconfiguration ruleset across Terraform, CloudFormation, Kubernetes manifests and Dockerfiles, mapping each issue to compliance controls.

How to use it

  1. 1Open a project and choose IaC.
  2. 2Connect the repository containing your infrastructure code.
  3. 3Run the scan and fix the highest-severity misconfigurations first.

When to use it

  • Shift-left cloud hardening.
  • Proving infra meets a benchmark before deploy.

Tips & best practices

  • Run IaC scans in CI so misconfigurations block the merge.

FAQ

Which formats are supported?
Terraform, CloudFormation, Kubernetes YAML and Dockerfiles.

Related guides

Container & cloud posture (CSPM / KSPM)

Find misconfigurations in cloud accounts, containers and Kubernetes.

Secrets scanning

Find passwords, API keys and tokens accidentally committed to code.

Vulnerabilities & findings

One prioritised inbox for every issue across every scan.