OpenParable
Skip to content
← Back to skills

Iac Security Scanner

DevOps & Security
iac-security-scanner

Iac Security Scanner is an Agent Skill for devops & security published in the a5c-ai/babysitter repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Infrastructure as Code security scanning and policy enforcement for Terraform, CloudFormation, Kubernetes, and Pulumi

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/a5c-ai/babysitter/blob/HEAD/library/specializations/security-compliance/skills/iac-security-scanner/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/iac-security-scanner, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

IaC Security Scanner Skill

Purpose

Infrastructure as Code security scanning and policy enforcement to identify misconfigurations, security vulnerabilities, and compliance violations in cloud infrastructure definitions before deployment.

Capabilities

Terraform Security Scanning

  • Scan Terraform configurations for security misconfigurations
  • Check for exposed resources (public S3 buckets, open security groups)
  • Validate encryption settings for data at rest and in transit
  • Detect hardcoded secrets in Terraform files
  • Analyze Terraform state files for sensitive data exposure

CloudFormation Analysis

  • Scan CloudFormation templates for security issues
  • Check IAM policy configurations for least privilege
  • Validate network configuration security
  • Detect insecure default configurations

Kubernetes Manifest Scanning

  • Analyze Kubernetes YAML manifests for security issues
  • Check pod security standards compliance
  • Validate resource limits and quotas
  • Detect privileged containers and host path mounts

Pulumi Code Analysis

  • Scan Pulumi TypeScript/Python code for security issues
  • Check cloud resource configurations
  • Validate security best practices

Policy Enforcement

  • Define and enforce custom security policies using OPA/Rego
  • Create guardrails for cloud resource configurations
  • Block deployments that violate security policies
  • Generate policy compliance reports

Compliance Mapping

  • Map findings to compliance frameworks (CIS, NIST, SOC 2, PCI-DSS)
  • Generate compliance gap analysis reports
  • Track remediation progress against compliance requirements

Integrations

  • Checkov: Multi-cloud IaC scanner by Bridgecrew
  • tfsec: Terraform security scanner
  • KICS: Keeping Infrastructure as Code Secure
  • Terrascan: IaC security scanner
  • OPA/Rego: Policy as code engine
  • Snyk IaC: Infrastructure as Code security testing

Target Processes

  • IaC Security Scanning Process
  • Cloud Security Architecture Review
  • DevSecOps Pipeline Integration
  • Infrastructure Deployment Pipeline
  • Compliance Continuous Monitoring

Input Schema

{
  "type": "object",
  "properties": {
    "iacPath": {
      "type": "string",
      "description": "Path to IaC files or directory"
    },
    "iacType": {
      "type": "string",
      "enum": ["terraform", "cloudformation", "kubernetes", "pulumi", "arm", "ansible"],
      "description": "Type of IaC to scan"
    },
    "scanners": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["checkov", "tfsec", "kics", "terrascan", "snyk"]
      },
      "description": "Scanners to use"
    },
    "complianceFrameworks": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["CIS", "NIST", "SOC2", "PCI-DSS", "HIPAA", "GDPR"]
      }
    },
    "customPolicies": {
      "type": "string",
      "description": "Path to custom OPA/Rego policies"
    },
    "severityThreshold": {
      "type": "string",
      "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW"]
    },
    "excludePaths": {
      "type": "array",
      "items": { "type": "string" }
    }
  },
  "required": ["iacPath", "iacType"]
}

Output Schema

{
  "type": "object",
  "properties": {
    "scanId": {
      "type": "string"
    },
    "iacPath": {
      "type": "string"
    },
    "scanTimestamp": {
      "type": "string",
      "format": "date-time"
    },
    "summary": {
      "type": "object",
      "properties": {
        "totalFiles": { "type": "integer" },
        "filesScanned": { "type": "integer" },
        "passedChecks": { "type": "integer" },
        "failedChecks": { "type": "integer" },
        "skippedChecks": { "type": "integer" }
      }
    },
    "findings": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "checkId": { "type": "string" },
          "severity": { "type": "string" },
          "resourceType": { "type": "string" },
          "resourceName": { "type": "string" },
          "filePath": { "type": "string" },
          "lineNumber": { "type": "integer" },
          "description": { "type": "string" },
          "remediation": { "type": "string" },
          "complianceMapping": { "type": "array" }
        }
      }
    },
    "complianceReport": {
      "type": "object"
    },
    "recommendations": {
      "type": "array",
      "items": { "type": "string" }
    }
  }
}

Usage Example

skill: {
  name: 'iac-security-scanner',
  context: {
    iacPath: './infrastructure/terraform',
    iacType: 'terraform',
    scanners: ['checkov', 'tfsec'],
    complianceFrameworks: ['CIS', 'SOC2'],
    severityThreshold: 'MEDIUM'
  }
}