SonarSource/sonar-iac

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.

Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.

CodeQL Extractor, Library, and Queries for Infrastructure as Code

Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.

The CoGuard CLI Tool

This GitHub Action runs Checkov against infrastructure-as-code, open source packages, container images, and CI/CD configurations to identify misconfigurations, vulnerabilities, and license compliance issues.

Tfsec is now part of Trivy

A docker container to simplify and secure the use of Infrastructure as Code (IaC)

ASH is an extensible, open source SAST, SCA, and IaC security scanner orchestration engine.