A static code analyzer that detects security and compliance violations in Infrastructure as Code before provisioning cloud infrastructure.
Terrascan is a static code analyzer that scans Infrastructure as Code (IaC) files for security misconfigurations, compliance violations, and vulnerabilities. It helps developers and DevOps teams identify risks before provisioning cloud infrastructure, supporting multiple IaC providers like Terraform, Kubernetes, and CloudFormation.
DevOps engineers, cloud infrastructure teams, and security professionals who manage Infrastructure as Code and need to enforce security and compliance standards in their CI/CD pipelines.
Terrascan offers extensive policy coverage across major cloud providers and IaC formats, integrates seamlessly into CI/CD workflows, and provides customizable scanning options to fit specific security requirements.
Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Includes over 500 policies for AWS, Azure, GCP, Kubernetes, Docker, and GitHub, ensuring comprehensive security checks across major cloud providers and IaC formats.
Scans Terraform, CloudFormation, ARM, Kubernetes, Helm v3, Kustomize, and Dockerfiles, making it versatile for diverse infrastructure stacks.
Can be seamlessly integrated into CI/CD workflows to enforce security automatically, with documentation providing specific guidance for various pipelines.
Integrates with AWS ECR, Azure, GCP, and Harbor registries to detect Docker image vulnerabilities, adding a layer of container security beyond IaC.
The repository is no longer maintained, meaning no future updates, bug fixes, or support for new IaC features, cloud services, or security policies.
Docker vulnerability scanning requires authentication and environment setup for container registries, which can be cumbersome and error-prone to configure.
Primarily focuses on static code analysis and drift monitoring, so it may not detect runtime issues or dynamic misconfigurations in live, provisioned infrastructure.