IaC Scanning

Infrastructure-as-code templates are checked by Onam Code Security as part of every repository scan. Terraform (.tf), YAML (Kubernetes manifests, CloudFormation), JSON and Dockerfiles found in the repository go to the IaC checker in the same scan job as static analysis and dependency analysis.

Full detail, including what is not supported, is on IaC and Dockerfile checks.

In brief

• Formats: Terraform, Kubernetes YAML, CloudFormation (YAML or JSON) and Dockerfiles.
• Not supported: rendered Helm charts (templates are read as files), Bicep, Pulumi programs and Kustomize builds.
• Separate rules from posture. IaC checks use their own rule set, distinct from the rules the CSPM engine evaluates against running resources.
• No CI plugin. Scans run from the console or the API; see CI usage.

For running Kubernetes clusters rather than manifests, see Container Security.