Checkmarx KICS IaC Security Scanner - Support

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

KICS (Keeping Infrastructure as Code Secure) is the open source static analysis scanner from Checkmarx that finds security misconfigurations and compliance issues in your infrastructure-as-code before deployment. It parses Terraform, CloudFormation, Kubernetes manifests, Ansible, Dockerfile and Docker Compose, Helm, ARM and Bicep, OpenAPI, Pulumi, Crossplane and more, reporting where declared infrastructure violates a security or compliance rule - a storage bucket with no encryption, a security group open to the world, a container running as root.

KICS is integrated into GitLab 14.5 as a default IaC scanner, reflecting broad industry trust in its detection engine. This AMI delivers KICS fully installed with its pinned query library in place, so you can SSH in and run a real scan within minutes of launch.

## Why This AMI Instead of Self-Install

Installing KICS yourself means managing Go dependencies, pinning a compatible query library version, configuring scheduled scans via cron, and packaging for air-gapped environments. This AMI eliminates that work:

• Verified pinned release - no dependency drift or version mismatch between scanner and query library
• Zero-config scheduled scanning - a systemd timer runs daily scans automatically, unlike manual cron setup
• Air-gap ready out of the box - no custom packaging needed for isolated subnets
• Zero-flag wrapper - run kics-scan with no arguments to scan the default target directory immediately

Compared to hosted alternatives, this AMI keeps all code and results on your own infrastructure with no data leaving your VPC.

## Scans Fully Offline

The scanner binary and its entire library of over 1800 Rego queries are installed locally and pinned to a single verified release. KICS needs no network egress to scan. It runs in a locked-down subnet with no internet access, making it a natural fit for scanning infrastructure code in secure or air-gapped environments.

## Shift Security Left

Catch insecure infrastructure at author time, in code review, and in CI - not in a post-incident review. KICS ships thousands of built-in queries keyed to common cloud frameworks and compliance benchmarks, delivering meaningful findings out of the box with no rule authoring. Run it against a single file, a whole module tree, or a directory of manifests, and get machine-readable JSON and SARIF output naming each failed query, its severity, and the resource, file and line it applies to.

## Scheduled Scanning Built In

A daily systemd timer scans a drop-in target directory and writes JSON and SARIF reports with a stable latest symlink for CI pickup. Leave infrastructure code in one place and have it re-checked automatically. Wire the same command into your pipeline to gate merges on a clean scan.

## Honest, Credential-Free Design

KICS has no login, no web interface, no daemon and no network port. Its entire management surface is the command line plus SSH with your own key. There is nothing to rotate and nothing to leak. Scan results remain on the local EBS volume under your control.

## Getting Started

1. Launch the AMI in your preferred VPC (works in public or private subnets)

2. SSH in with your key pair

3. Run kics version to confirm the toolchain

4. Run kics-scan against the bundled insecure sample to see real detections

5. Point kics-scan at your own infrastructure code directory

A deliberately insecure sample and a clean sample ship read-only on the image so you can prove the scanner detects a real misconfiguration and passes clean code on your very first login.

## Use Cases

• A ready-to-run workstation for auditing IaC against security and compliance rules
• A CI runner image that gates merges on a clean policy scan
• A training and evaluation sandbox for teams adopting IaC security scanning
• An air-gapped scanning node for regulated environments

## cloudimg Support

24/7 technical support by email and live chat. Help with running scans, interpreting findings, writing exclusions and custom queries, wiring KICS into CI, and keeping your infrastructure code compliant.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.