> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codethreat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Infrastructure as Code Security

> Deterministic scanning of Terraform, Kubernetes, Docker, and cloud configurations

Infrastructure misconfigurations are a leading cause of cloud breaches. CodeThreat performs deterministic scanning of IaC files to identify security misconfigurations before deployment.

## What We Detect

<CardGroup cols={2}>
  <Card title="Misconfigurations" icon="cloud-exclamation">
    Publicly exposed databases and storage buckets
  </Card>

  <Card title="Compliance Violations" icon="file-shield">
    CIS benchmarks and security best practices
  </Card>

  <Card title="Privilege Escalation" icon="user-shield">
    Overly permissive IAM roles
  </Card>

  <Card title="Resource Exposure" icon="unlock">
    Unencrypted data and open ports
  </Card>
</CardGroup>

***

## Supported Infrastructure

### Cloud Platforms

* **AWS**: CloudFormation, CDK, IAM policies, Security groups, S3 buckets
* **Azure**: ARM templates, Bicep, Network security groups, Storage accounts
* **GCP**: Deployment Manager, IAM policies, Firewall rules, Cloud Storage

### IaC Tools

* **Terraform**: HCL files and modules
* **Kubernetes**: YAML manifests and Helm charts
* **Docker**: Dockerfiles and compose files
* **Ansible**: Playbooks and roles
* **CloudFormation**: JSON and YAML templates
* **Pulumi**: TypeScript, Python, Go

[View complete IaC support matrix →](/reference/iac-support-matrix)

***

## Common Vulnerabilities

### Public Storage Buckets

```hcl theme={null}
# ❌ Vulnerable
resource "aws_s3_bucket" "data" {
  bucket = "company-data"
  acl    = "public-read"
}

# ✅ Secure
resource "aws_s3_bucket" "data" {
  bucket = "company-data"
}

resource "aws_s3_bucket_public_access_block" "data" {
  bucket = aws_s3_bucket.data.id
  block_public_acls = true
  block_public_policy = true
}
```

### Unrestricted Security Groups

```hcl theme={null}
# ❌ Vulnerable - Open to world
resource "aws_security_group" "web" {
  ingress {
    from_port   = 0
    to_port     = 65535
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# ✅ Secure - Internal only
resource "aws_security_group" "web" {
  ingress {
    from_port   = 443
    to_port     = 443
    cidr_blocks = ["10.0.0.0/8"]
  }
}
```

### Kubernetes Security

```yaml theme={null}
# ❌ Vulnerable
securityContext:
  privileged: true
  runAsUser: 0

# ✅ Secure
securityContext:
  runAsNonRoot: true
  runAsUser: 1000
  allowPrivilegeEscalation: false
  capabilities:
    drop: ["ALL"]
```

***

## Compliance Frameworks

<CardGroup cols={2}>
  <Card title="CIS Benchmarks" icon="bookmark">
    AWS, Azure, GCP, Kubernetes
  </Card>

  <Card title="PCI DSS" icon="credit-card">
    Payment card industry standards
  </Card>

  <Card title="HIPAA" icon="heart-pulse">
    Healthcare data protection
  </Card>

  <Card title="SOC 2" icon="building-shield">
    Service organization controls
  </Card>
</CardGroup>

***

## Container Image Scanning

Scan Docker images for vulnerabilities in base images and dependencies.

```bash theme={null}
codethreat image scan myapp:latest
```

Scans detect:

* OS vulnerabilities in base images
* Application CVEs in dependencies
* Secrets in image layers
* Dockerfile best practices

***

## Configuration

Configure IaC scanning in repository settings:

* Enable/disable IaC scanning
* Select frameworks to scan
* Set severity thresholds
* Configure compliance frameworks
* Enable drift detection

***

## Best Practices

* Scan IaC files in CI/CD before deployment
* Use policy as code for compliance
* Monitor configuration drift
* Keep base images updated
* Automate remediation for common issues

***

## Next Steps

<CardGroup cols={2}>
  <Card title="Project Settings" icon="gear" href="/configuration/project-settings">
    Configure IaC scanning
  </Card>

  <Card title="CI/CD Integration" icon="arrows-spin" href="/automation/ci-cd-integration">
    Add to your pipeline
  </Card>
</CardGroup>