Infrastructure as Code Security: Scanning Terraform, CloudFormation, and Pulumi

Shifting Cloud Security Left with IaC Scanning

Infrastructure as Code (IaC) enables teams to define cloud infrastructure in version-controlled files. This creates an opportunity to catch security misconfigurations before resources are deployed. It is the ultimate shift-left security practice.

Why Scan IaC?

The Cost of Late Detection

Configuration Drift

Even with IaC, manual changes create drift between defined and actual state. Continuous scanning detects drift and enforces compliance.

Common IaC Security Issues

Terraform Misconfigurations

# INSECURE: Public S3 bucket
resource "aws_s3_bucket" "data" {
  bucket = "company-data"
  acl    = "public-read"  # Flagged!
}

# INSECURE: Open security group
resource "aws_security_group" "web" {
  ingress {
    from_port   = 0
    to_port     = 65535
    cidr_blocks = ["0.0.0.0/0"]  # Flagged!
  }
}

# INSECURE: Unencrypted RDS
resource "aws_db_instance" "main" {
  storage_encrypted = false  # Flagged!
}

CloudFormation Issues

# INSECURE: Default VPC usage, no encryption, open ports
Resources:
  Instance:
    Type: AWS::EC2::Instance
    Properties:
      SecurityGroupIds:
        - !Ref OpenSecurityGroup  # Too permissive

Scanning Tools and Integration

CI/CD Integration

# GitHub Actions example
- name: Terraform Security Scan
  run: |
    tfsec .
    checkov -d .
    terrascan scan -t aws -d .

Policy as Code

Define custom security policies:

# OPA/Rego policy
deny[msg] {
    resource := input.resource.aws_s3_bucket[name]
    resource.acl == "public-read"
    msg := sprintf("S3 bucket '%v' must not be public", [name])
}

Best Practices

• Scan IaC in every pull request
• Block merges on critical findings
• Use pre-commit hooks for immediate feedback
• Maintain custom policies for organization-specific requirements
• Track security debt and remediation velocity

Where SuperClue Fits

SuperClue does not have an IaC rule engine for Terraform, CloudFormation, Pulumi, or Kubernetes manifests. Its DAST scanner does check whether Terraform files (including state and variable files) or CloudFormation templates can be downloaded from your website, and its AI Code Security Analysis can review Terraform files and Dockerfiles in a connected repository alongside your application code.