KICS IaC Security Scanner

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

Overview

KICS (Keeping Infrastructure as Code Secure) is the open source static analysis scanner from Checkmarx that finds security misconfigurations and compliance issues in your infrastructure-as-code before it is ever deployed. It parses Terraform, CloudFormation, Kubernetes manifests, Ansible, Dockerfile and Docker Compose, Helm, ARM and Bicep, OpenAPI, Pulumi, Crossplane and more, and reports where the declared infrastructure violates a security or compliance rule: a storage bucket with no encryption, a security group open to the world, a container running as root. It ships an embedded library of over 1800 Rego queries and is a staple of shift-left cloud security and CI gating. This image delivers KICS fully installed with its pinned query library in place, so an engineer can connect over SSH and run a real scan within moments of launch.

Scans Fully Offline

The scanner binary and its entire query library are installed locally and pinned to a single verified release, so KICS needs no network egress to scan. It runs happily in a locked-down subnet with no internet access, which makes it a natural fit for scanning infrastructure code in a secure or air-gapped environment.

Shift Security Left

Catch insecure infrastructure at author time, in code review, and in CI, instead of in a post-incident review. KICS ships thousands of built-in queries keyed to the common cloud frameworks and compliance benchmarks, so you get meaningful findings out of the box with no rule authoring. Run it against a single file, a whole module tree, or a directory of manifests, and get machine-readable JSON and SARIF output naming each failed query, its severity, and the resource, file and line it applies to.

Ready To Use

The pinned scanner, the query library and a zero-flag wrapper are all in place. Run kics version to confirm the toolchain, then point kics-scan at any path of infrastructure code. A deliberately insecure sample and a clean sample ship read-only on the image so you can prove the scanner detects a real misconfiguration and passes clean code on your very first login.

Scheduled Scanning Built In

A daily systemd timer scans a drop-in target directory and writes JSON and SARIF reports with a stable latest symlink for CI pickup, so you can leave infrastructure code in one place and have it re-checked automatically. Findings are the product working as designed: review each one, fix the code, or exclude it. Wire the same command into your pipeline to gate merges on a clean scan.

Honest, Credential-Free Design

KICS has no login, no web interface, no daemon and no network port. Its entire management surface is the command line plus SSH with your own key. There is nothing to rotate and nothing to leak, which is the strongest possible posture, reported plainly rather than papered over with a manufactured password.

cloudimg Support

24/7 technical support by email and chat. Help with running scans, interpreting findings, writing exclusions and custom queries, wiring KICS into CI, and keeping your infrastructure code compliant.

Use Cases

A ready-to-run workstation for auditing infrastructure-as-code against security and compliance rules. A CI runner image that gates merges on a clean policy scan. A training and evaluation sandbox for teams adopting infrastructure-as-code security scanning.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.