soldevelo/infrascan repository overview

⁠SolDevelo InfraScan

Open source scanner for Infrastructure as Code: cost, security and container vulnerabilities, in your terminal or CI.

InfraScan checks Terraform, CloudFormation, Kubernetes, Helm, Ansible and the container images they use. It grades the result A to F, puts a monthly price on cost findings, and runs entirely on your machine or runner.

⁠🚀 Quick start

docker run --rm -v $(pwd):/scan soldevelo/infrascan:latest

Scans the current directory with every scanner and prints the report in your terminal.

⁠✨ What it checks

• 💰 Cost: 27 Terraform rules (old instance generations, gp2 instead of gp3, idle NAT Gateways, missing S3 lifecycle rules, missing budgets, oversized Lambda memory and more), with an estimated saving in $/month per finding.
• 🛡️ IaC security: Checkov's 1000+ policies for Terraform, CloudFormation, Kubernetes, Helm and Ansible.
• 🐳 Containers: CVEs in the images referenced by Docker Compose files and Kubernetes manifests, with Grype or Docker Scout (when Docker Hub credentials are set). Handles ${VAR} in image names and Amazon ECR.
• 📊 Grades and deltas: an A to F grade per category, and with a baseline, only the findings and cost changes a pull request adds.

⁠🛠️ Options

docker run --rm -v $(pwd):/scan soldevelo/infrascan:latest [options]

• --scanner: comprehensive (default), regex, checkov, containers, or a comma-separated mix.
• --format: text (default), json, html. --out saves the report, e.g. --out /scan/report.html.
• --framework: smart (default), auto, terraform, kubernetes, cloudformation, helm, ansible, all.
• -f, --include: scan only these files or directories.
• -x, --exclude: leave paths out, e.g. -x docs,tests,examples (names match at any depth, like .gitignore).
• --fail-on: exit code 1 on any, high_critical, a grade (grade_a to grade_f), a priority, or only on findings a PR adds (new_any, new_high_critical, new_critical).
• --no-tips: leave out the one-line mention of InfraScan Cloud.

⁠🤖 CI/CD

GitHub Actions (PR comments, step summary, inline annotations, baseline per branch):

- uses: actions/checkout@v4
- uses: soldevelo/infrascan@v1
  with:
    format: html
    out: infrascan-report.html
    fail-on: new_high_critical

Bitbucket Pipelines (PR comment, Code Insights report and annotations):

- pipe: docker://soldevelo/infrascan:latest
  variables:
    FORMAT: html
    OUT: infrascan-report.html

GitLab CI and anything else that runs Docker: the docker run command above.

Full setup: GitHub Action⁠ · Bitbucket pipe⁠ · README⁠

⁠🏷️ Tags

• latest: the newest release.
• 1.2.5, 1.2.4, ...: a specific release. Pin one for reproducible results. The GitHub Action pins the image of its own version from 1.2.5 on.

⁠🤝 Community

• GitHub: SolDevelo/InfraScan⁠ (issues and contributions welcome)
• Slack: Join the community⁠
• Contact: soldevelo.com/contact⁠