Open-source alternatives to Terrascan

Extensible auto-tagger for your IaC files. The ultimate way to link entities in the cloud back to the codified resource which created it.

cdk8s is a Kubernetes infrastructure as code framework and manifest generator. It provides a cloud native development environment for defining system components and reusable abstractions using general purpose programming languages, which are then synthesized into standard YAML manifests. The framework uses a declarative API and object-oriented modeling to transform code into pure manifest files. These files are generated for use with any Kubernetes cluster via existing deployment tools. The project enables the creation of hierarchical resource patterns and reusable abstractions. It employs s

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.

Clair is a container vulnerability scanner that performs static analysis of container images to identify known security vulnerabilities. It functions as an analyzer for OCI and Docker images, indexing their contents to detect security risks and outdated packages without requiring the containers to be running. The tool identifies vulnerabilities by matching indexed container components against security databases to find common vulnerabilities and exposures. This process involves analyzing filesystem layers to track the provenance and versioning of packages across the image hierarchy. The proj

A best practices checker for Kubernetes clusters. 🤠

a lightweight, security focused, BDD test framework against terraform.

Regula checks infrastructure as code templates (Terraform, CloudFormation, k8s manifests) for AWS, Azure, Google Cloud, and Kubernetes security and compliance using Open Policy Agent/Rego

Container Image Linter for Security, Helping build the Best-Practice Docker Image, Easy to start

Bloaty is a binary size profiler and executable format analyzer that attributes every byte of a binary to specific symbols or compile units. It functions as a compilation unit profiler and C++ symbol demangler, mapping binary size back to source files and translating mangled names into human-readable formats. The project distinguishes itself as a binary diffing tool capable of comparing two versions of a binary to isolate specific symbols or sections responsible for size regressions. It provides specialized support for recovering symbols in stripped binaries by associating them with external

Terraform is a declarative infrastructure-as-code tool designed to manage the lifecycle of cloud and on-premises resources. It functions as a workflow engine that reconciles a defined desired state against real-world infrastructure, using a persistent state-tracking layer to maintain consistency and visibility across distributed environments. By mapping infrastructure components into a directed acyclic graph, the system calculates the optimal order for provisioning, updating, or destroying resources. The platform is distinguished by its extensible plugin-based architecture, which decouples co

CLI tool for linting and testing Helm charts

Linker/Compiler/Tool detector for Windows, Linux and MacOS.

The Jakstab static analysis platform for binaries

tfsec is a static analysis tool and security scanner for Terraform configuration files. It functions as an infrastructure as code security scanner and compliance linter designed to detect misconfigurations and vulnerabilities across multiple cloud providers before resources are deployed. The tool identifies security risks by analyzing infrastructure code and variable files to evaluate the final state of the environment. It supports custom policy enforcement and allows for the suppression of specific security warnings through inline comments. Its capabilities cover cloud security posture mana

Hadolint is a Dockerfile linter and Haskell-based static analysis tool. It analyzes container image configuration files against a set of rules to ensure valid syntax and adherence to best practices. The tool functions as a wrapper for shell checkers to inspect inline shell commands and scripts within build instructions, identifying scripting errors and bugs. It also includes security auditing capabilities to warn when images are pulled from registries not explicitly listed as trusted. The analysis engine covers quality assurance through label schema validation, syntax pattern verification, a

A binary static analysis tool that provides security and correctness results for Windows Portable Executable and *nix ELF binary formats

Unit testing framework for test driven security of AWS, GCP, Heroku and more.

This script will help you achieve 100%, or nearly 100%, compliance.

forks-shield: https://img.shields.io/github/forks/NotHarshhaa/AWS-Projects?style=for-the-badge&logo=github&logoColor=white&color=orange forks-url: https://github.com/NotHarshhaa/AWS-Projects/network/members

OpenTofu is a declarative infrastructure orchestrator that automates the provisioning and management of cloud resources. It functions as a platform-agnostic interface, allowing users to define their desired environment state in configuration files, which the system then reconciles against live infrastructure to calculate and execute necessary updates. The project utilizes a graph-based execution engine to determine the optimal sequence for resource operations, enabling the parallel processing of independent components to reduce deployment times. To support complex, multi-platform environments

Packj stops :zap: Solarwinds-, ESLint-, and PyTorch-like attacks by flagging malicious/vulnerable open-source dependencies ("weak links") in your software supply-chain

a framework for building java codemods

Pulumi is an infrastructure-as-code framework that enables the definition, deployment, and management of cloud resources using general-purpose programming languages. It functions as a cloud resource orchestrator that coordinates the lifecycle of heterogeneous infrastructure by executing code to construct dependency graphs and reconciling the desired state against actual cloud environments. The platform distinguishes itself through a language-host runtime bridge that allows developers to use standard programming languages to define infrastructure, rather than relying solely on domain-specific

Serverless plugin for least privileges.

Twiggy🌱 is a code size profiler