Awesome GitHub RepositoriesInfrastructure as Code Security

The OWASP Cheat Sheet Series is a comprehensive, community-driven repository of concise security best practices and defensive coding patterns. It serves as a centralized knowledge base for developers and security professionals, providing actionable guidance to secure applications across the entire software development lifecycle. The project covers a vast array of security domains, ranging from fundamental web application hardening and authentication protocols to specialized controls for modern infrastructure and artificial intelligence systems. What distinguishes this project is its decentral

Subfinder is a security reconnaissance framework designed for subdomain enumeration and attack surface management. It functions as a discovery engine that identifies and maps internet-exposed infrastructure, cloud-hosted assets, and network ranges to maintain a comprehensive inventory of an organization's digital footprint. The project distinguishes itself through a modular, template-driven scanning engine that executes security checks against discovered assets. It leverages cloud-native asset discovery to query provider APIs and infrastructure metadata, while supporting distributed agent orc

Kubescape is a Kubernetes security posture management platform designed to scan clusters, manifests, and images for misconfigurations, vulnerabilities, and compliance risks. It functions as a comprehensive security suite incorporating a compliance scanner, a container image vulnerability scanner, an admission controller for policy enforcement, and a runtime security monitor. The platform distinguishes itself through runtime-aware vulnerability filtering, which maps libraries loaded in memory to determine if vulnerabilities are actually reachable. It also integrates with AI assistants via a Mo

Kubescape is a security platform for Kubernetes that provides tools for scanning clusters, configurations, and container images against industry compliance and security benchmarks. It functions as a suite of security utilities, including a compliance auditor, a misconfiguration scanner, and a container vulnerability scanner. The project differentiates itself through automated remediation and active enforcement. It can automatically patch operating system vulnerabilities in images and fix security errors within manifest files. It also utilizes an admission controller to block the deployment of

Nikto is an open-source HTTP security auditing tool and web server vulnerability scanner. It functions as a reconnaissance engine designed to identify insecure server options, outdated software, and common vulnerabilities by analyzing HTTP responses. The project differentiates itself through capabilities for intrusion detection evasion and web server fingerprinting. It uses request-level encoding and timing spacers to bypass security filters and employs signature-based identification to determine specific server software versions and misconfigurations. The scanner covers broad capability are

Checkov is a static analysis tool and security scanner designed to identify misconfigurations in infrastructure as code, container images, and Kubernetes configurations. It functions as a cloud security posture tool, an SCA vulnerability scanner, and a secret scanning utility to prevent security breaches and version control leaks. The project distinguishes itself through deep graph analysis and variable resolution, allowing it to map relationships between interconnected resources and evaluate the final state of infrastructure attributes. It provides extensibility for defining custom security

tfsec is a static analysis tool and infrastructure as code linter designed to detect security misconfigurations and compliance violations in Terraform infrastructure code. It functions as a cloud security posture tool and policy enforcement engine that evaluates configurations against established security benchmarks. The tool provides multi-cloud security auditing for providers including AWS, Azure, Google Cloud, and Kubernetes, as well as specialized scanning for DigitalOcean, OpenStack, CloudStack, and GitHub configurations. It identifies insecure settings such as public access or unencrypt

tfsec is a static analysis tool and security scanner for infrastructure as code, specifically designed to detect misconfigurations and compliance violations in Terraform and cloud infrastructure definitions before deployment. It functions as a cloud security policy engine that identifies vulnerabilities across multiple cloud platforms. The tool provides capabilities for cloud compliance auditing and scanning of Cloud Development Kit code. It supports custom security policy enforcement and allows for the definition of organization-specific security requirements. The scanner includes features

tfsec is a static analysis tool and security scanner for Terraform configuration files. It functions as an infrastructure as code security scanner and compliance linter designed to detect misconfigurations and vulnerabilities across multiple cloud providers before resources are deployed. The tool identifies security risks by analyzing infrastructure code and variable files to evaluate the final state of the environment. It supports custom policy enforcement and allows for the suppression of specific security warnings through inline comments. Its capabilities cover cloud security posture mana

Cloud Custodian هو محرك حوكمة متعدد السحابة وأداة لإنفاذ السياسات مصممة لأتمتة الأمان والامتثال وتحسين التكلفة عبر مزودي السحابة المختلفين. يعمل كمحرك قواعد يستخدم لغة مجال تعريفية للاستعلام عن موارد السحابة وتنفيذ إجراءات تصحيحية بناءً على فلاتر محددة مسبقاً. يعمل النظام كمنسق سياسات بدون خادم، حيث ينشر وظائف خاصة بالمزود لتشغيل الإنفاذ في الوقت الفعلي استجابة لتغييرات موارد السحابة. يوفر تجريداً للموارد محايداً للمزود للحفاظ على سياسات تشغيلية متسقة عبر حسابات واشتراكات ومشاريع متعددة. تغطي قدراته تدقيق البنية التحتية السحابية، بما في ذلك تحليل الأصول داخل خطوط أنابيب التكامل المستمر وإنشاء تقارير الامتثال. تدعم الأداة أيضاً تحسين التكلفة لتحديد وإزالة الموارد غير المستخدمة وتتضمن وضع محاكاة لتحديد الموارد المتأثرة دون تطبيق تغييرات فعلية.

Naabu is a port scanner library and tool that probes hosts for open ports using SYN, CONNECT, and UDP methods to identify active services. It functions as a Go library for embedding port scanning into programs, and as a standalone tool that accepts targets as hostnames, IP addresses, CIDR ranges, or ASN numbers. The tool discovers live hosts before scanning, filters ports by range or top lists, and can integrate with Nmap for service version detection. The project distinguishes itself through its SYN-based port probing approach that sends TCP SYN packets and analyzes responses without complet

Snyk is an application security testing platform designed to identify and remediate vulnerabilities across source code, open-source dependencies, container images, and infrastructure-as-code configurations. It functions as a comprehensive security workflow automation tool, utilizing a static analysis engine and dependency graph mapping to detect security flaws and license compliance issues throughout the software development lifecycle. The platform distinguishes itself through agentic workflow orchestration and an automated remediation pipeline that generates and submits pull requests to patc

Terrascan هي أداة تحليل ثابت مصممة لتقييم ملفات تكوين البنية التحتية ككود بحثاً عن ثغرات أمنية وانتهاكات الامتثال. من خلال تحليل هذه الملفات إلى تمثيل وسيط، تحدد المخاطر قبل توفير موارد السحابة، وتعمل كمدقق امتثال للبيئات السحابية الأصلية. تعمل الأداة كمحرك سياسة ككود، مما يسمح للمستخدمين بتعريف وإنفاذ قواعد أمان مخصصة ومعايير الصناعة باستخدام لغة استعلام متخصصة. تتميز بقدرتها على التكامل مباشرة في سير عمل التطوير والنشر، مما يوفر حواجز أمان آلية يمكنها حظر عمليات النشر غير المتوافقة عبر التقارير القائمة على كود الخروج. بعيداً عن التحليل الثابت، تدعم المنصة مسح ثغرات سجل الحاويات لربط المخاطر القائمة على الصور بتكوينات البنية التحتية. كما توفر مراقبة انحراف التكوين لتتبع الموارد الموفرة مقابل خطوط أساس الأمان المعمول بها، إلى جانب آليات قمع مدفوعة بالتكوين لإدارة تجاوزات السياسة والإيجابيات الكاذبة. يوفر البرنامج كلاً من واجهة سطر أوامر للتحقق من التطوير المحلي وواجهة برمجة تطبيقات مسح يمكن الوصول إليها عبر الشبكة للتكامل عن بُعد مع أنظمة الطرف الثالث وخطوط الأنابيب الآلية.

RBAC Manager is a Kubernetes operator that automates the management of role-based access control and service account permissions. It functions as a controller that synchronizes cluster authorization resources with user-defined configuration files, ensuring that security settings remain consistent with established requirements. The system operates by monitoring the cluster API for changes and reconciling the current state against declarative manifests. By treating authorization as infrastructure as code, it enables teams to manage permissions through version-controlled files rather than manual