Skip to content

v1.6.0

v1.6.0: feat: IaC Misconfiguration Scanner (v6.0.0)
@OmarRao OmarRao tagged this 18 Jun 15:29 
New iac_scanner.py — 50+ pattern checks across 6 frameworks:
- Terraform: public S3, open SGs, wildcard IAM, disabled encryption,
  publicly accessible RDS, hardcoded credentials, no deletion protection
- Kubernetes: privileged containers, hostNetwork/PID, allowPrivilegeEscalation,
  root UID, wildcard RBAC, latest tags, missing resource limits
- Dockerfile: no USER (root), ADD vs COPY, latest base image, secrets in ENV,
  curl|bash, --privileged, missing HEALTHCHECK
- GitHub Actions: write-all perms, pull_request_target, unpinned actions,
  curl|bash in run steps, script injection via github.event.*
- CloudFormation: public RDS/S3, wildcard IAM, missing DeletionPolicy
- Ansible: become escalation, no_log:false, hardcoded passwords, TLS bypass

Checkov integration via subprocess — deep scan when installed, pattern
engine fallback for zero-dependency operation.

Server: /api/iac/frameworks endpoint + start_iac_scan Socket.IO handler
        integrated into main scan pipeline at pct 83
Dashboard: IaC panel with KPI strip, framework breakdown cards,
           severity filter, findings table, remediation guide
Assets 2
Loading