IaC Scanning & SecOps

Onam's SecOps engine scans Infrastructure-as-Code templates, application code, and open-source dependencies before they reach production — at pull-request time, in CI, and on demand. The goal is to catch security issues at the earliest, cheapest point in the SDLC: in the editor, before merge, before the pipeline deploys, before a real cloud resource exists.

This page covers the shift-left cost model, the five scan categories (SAST, IaC, SCA, DAST, secrets), language and template coverage, CI/CD integration with working configs, and the finding catalog.

The Shift-Left Model

The further left you catch an issue, the cheaper the fix. These are industry averages from IBM's Cost of a Data Breach report and NIST's software cost estimation studies:

Onam runs at every stage — IDE plugin, GitHub PR / GitLab MR comments, CI integration, and the unified posture dashboard. One rule catalog evaluates the same misconfiguration consistently across all stages, so a rule that fires in production CSPM also fires on the Terraform that would create it.

Capabilities

Five scan categories ship out of the box. Enable them individually per repository or run them together in one integrated scan.

A typical PR scan completes in 30–90 seconds for a ~50K LOC repo. Monorepos of 1M+ LOC take 5–10 minutes; PR-webhook scans are incremental and only analyze changed files.

SAST Language Coverage

SAST covers seven languages, each with a dedicated scanner plus shared semgrep rules, and additionally scans Kubernetes YAML manifests:

IaC Framework Coverage

A rule like "S3 bucket public access not blocked" fires identically against Terraform, CloudFormation, Pulumi, and Helm — wherever the template surfaces the misconfiguration. The rule catalog is unified across template languages, so there are not four rule sets to maintain.

CI/CD Integration

First-class integrations ship for the most common CI systems. Each runs the same scanner with the same rule catalog — only the orchestration differs.

GitHub Actions

# .github/workflows/onam-scan.yml
name: Onam Security Scan

on:
  pull_request:
    branches: [main, develop]
  push:
    branches: [main]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Onam IaC + SAST Scan
        uses: onam-io/secops-scan-action@v1
        with:
          api-key: ${{ secrets.ONAM_API_KEY }}
          scan-types: iac,sast,sca,secrets
          fail-on: CRITICAL,HIGH
          paths: |
            terraform/
            k8s/
            src/

      - name: Upload SARIF Results
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: onam-results.sarif
        if: always()

The action scans IaC templates and application code, checks dependencies (SCA), detects secrets, fails the job on Critical or High findings, and uploads SARIF to the GitHub Security tab.

GitLab CI

# .gitlab-ci.yml
onam-security-scan:
  stage: test
  image: onam/secops-scanner:latest
  script:
    - onam scan --type iac,sast,sca,secrets
                --api-key $ONAM_API_KEY
                --fail-on CRITICAL,HIGH
                --output sarif
  artifacts:
    reports:
      sast: onam-results.sarif
    when: always
  rules:
    - if: $CI_MERGE_REQUEST_IID
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

Jenkins

// Jenkinsfile
pipeline {
    agent any
    stages {
        stage('Onam Security Scan') {
            steps {
                sh '''
                    onam scan \
                      --type iac,sast,sca,secrets \
                      --api-key ${ONAM_API_KEY} \
                      --fail-on CRITICAL,HIGH \
                      --output junit \
                      --output-file onam-results.xml
                '''
            }
            post {
                always {
                    junit 'onam-results.xml'
                }
            }
        }
    }
}

Azure DevOps, CircleCI, Bitbucket Pipelines, and Buildkite use the same onam CLI.

Finding Categories

Findings come in two main dimensions — SAST findings (application code) and IaC findings (infrastructure templates). Each carries severity, CWE / CIS mappings, and a remediation suggestion.

SAST finding examples

IaC finding examples

Secrets Detection Patterns

120+ secret patterns across five categories. Each pattern combines a regex with an entropy or format check — high-entropy strings that match no known pattern are also flagged as "possible generic secret".

Pre-commit integration is available via pre-commit-onam-secrets — the same pattern set runs locally on every commit and blocks secrets before they ever reach the remote. Once a secret is pushed, rotating it is the only safe remediation; scrubbing git history is not enough.

Output Formats

API

# List SecOps findings for a repository
GET /api/v1/secops/findings?repo=github.com/org/repo&severity=CRITICAL

# Trigger a scan on a repository
POST /api/v1/secops/scan
Content-Type: application/json
{"repo_url": "https://github.com/org/repo", "branch": "main", "scan_types": ["iac", "sast", "sca"]}

# Get scan results by scan ID
GET /api/v1/secops/scans/{scan_id}/findings

Webhook delivery on every completed scan can be configured under Settings → Notifications.

FAQ

How does SecOps integrate with branch protection? The PR / MR integration posts a status check you can require in branch protection. Critical or High findings fail the check, blocking merge until resolved or suppressed.

Can I suppress a finding I've reviewed and accepted? Yes. Suppressions are file-and-line-anchored, require a documented justification, follow the file if it moves, and expire after 90 days by default unless renewed.

Does SCA scan dependencies recursively? Yes — full transitive analysis. A vulnerability in a dependency-of-a-dependency surfaces with its full path, so you can decide whether to bump the direct dependency or wait upstream.

Can I run SecOps on monorepos? Yes. Path-based scoping scans only changed paths on PRs, with per-path rule profiles (stricter for production/ than playground/).

What about AI-generated code? SAST treats it identically to human-written code. AI-generated code shows a slightly higher rate of hardcoded credentials and incomplete input validation — the same catalog catches both.

Can I use SecOps in air-gapped environments? Yes — on-premises deployment on Enterprise plans. The scanner runs entirely in your network, with rule updates pulled via a one-way mirror.

Next steps

• Vulnerability Management — the runtime side of the same CVE data
• Container Security — what happens to Helm and pod-spec issues after deploy
• Integration catalog — every supported CI, ticketing, and notification integration
• CSPM — the production-side rule catalog that mirrors these IaC rules