# accurics/terrascan **Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/accurics-terrascan).** _How this analysis was created: the description and tags below were written by an AI model that read this project's README and public documentation pages; stars, license and language come straight from the GitHub API. The model does not read the source code._ 5,210 stars · 552 forks · Go · Apache-2.0 · archived ## Links - GitHub: https://github.com/accurics/terrascan - Homepage: https://runterrascan.io - awesome-repositories: https://awesome-repositories.com/repository/accurics-terrascan.md ## Description Terrascan is an infrastructure as code security scanner and cloud configuration auditor designed to detect security violations and compliance risks in cloud templates and Dockerfiles before provisioning. It utilizes the Open Policy Agent to evaluate infrastructure templates against both standard security policies and custom organizational rules. The project functions as a security guardrail within build pipelines, blocking risky deployments by integrating scanning logic directly into CI/CD workflows. It also includes a container registry vulnerability scanner that collects vulnerability data from registries to augment infrastructure security reports. The toolset covers cloud compliance auditing, local development security testing, and policy enforcement. It provides a query language for defining custom security requirements and supports result suppression via configuration files to manage policy violations. Scanning capabilities can be accessed through a command line interface or via a background API server for external orchestration. ## Tags ### Development Tools & Productivity - [Policy-Based Validations](https://awesome-repositories.com/f/development-tools-productivity/configuration-file-validators/policy-based-validations.md) — Evaluates infrastructure configuration files against declarative logic and compliance rules using a policy engine. - [Policy Evaluation Engines](https://awesome-repositories.com/f/development-tools-productivity/configuration-driven-scanning-engines/benchmark-scanning/benchmark-driven-configurations/policy-evaluation-engines.md) — Utilizes the Open Policy Agent as an engine to evaluate infrastructure configurations against defined security policies and benchmarks. - [Analysis Suppressions](https://awesome-repositories.com/f/development-tools-productivity/formatting-suppression/analysis-suppressions.md) — Allows selectively ignoring specific rule violations using configuration files or annotations. ([source](https://cdn.jsdelivr.net/gh/accurics/terrascan@main/README.md)) ### Security & Cryptography - [Infrastructure as Code Scanners](https://awesome-repositories.com/f/security-cryptography/infrastructure-as-code-scanners.md) — Provides a specialized tool for scanning cloud configuration files and Dockerfiles to detect security risks before provisioning. - [Cloud Infrastructure Security Auditors](https://awesome-repositories.com/f/security-cryptography/cloud-infrastructure-security-auditors.md) — Analyzes cloud resource configurations against security rules across multiple cloud providers. - [Cloud Compliance Auditors](https://awesome-repositories.com/f/security-cryptography/governance-policy-frameworks/compliance-governance/regulatory-compliance/cloud-compliance-auditors.md) — Automates the evaluation of cloud infrastructure against regulatory frameworks and industry benchmarks. - [Compliance Policy Definitions](https://awesome-repositories.com/f/security-cryptography/governance-policy-frameworks/compliance-governance/security-and-compliance/compliance-policy-definitions.md) — Uses a specialized query language to define organizational security and compliance requirements for infrastructure. - [Pipeline Policy Enforcement](https://awesome-repositories.com/f/security-cryptography/infrastructure-policy-enforcement/security-policy-enforcers/pipeline-policy-enforcement.md) — Embeds security checks in CI/CD workflows to block risky deployments based on policy violations. ([source](https://runterrascan.io/products/identity-exposure)) - [Local Infrastructure Security Testing](https://awesome-repositories.com/f/security-cryptography/local-infrastructure-security-testing.md) — Enables security checks during local build processes to identify and fix misconfigurations before committing code. ([source](https://runterrascan.io/blog/terrascan-joins-the-nessus-community)) - [Container Image Vulnerability Scanners](https://awesome-repositories.com/f/security-cryptography/vulnerability-scanning/container-image-vulnerability-scanners.md) — Analyzes container images and manifests for known OS and application-layer vulnerabilities. ### DevOps & Infrastructure - [CI/CD Pipeline Integrations](https://awesome-repositories.com/f/devops-infrastructure/ci-cd-pipeline-integrations.md) — Provides native support for automating security checks within continuous integration and deployment workflows. ([source](https://runterrascan.io/solutions/data-center-security)) - [Security Scanning Integrations](https://awesome-repositories.com/f/devops-infrastructure/ci-cd-pipeline-integrations/security-scanning-integrations.md) — Embeds vulnerability scanning into pipelines to enforce policy-based build failures and block risky deployments. - [Continuous Integration Pipelines](https://awesome-repositories.com/f/devops-infrastructure/continuous-integration-pipelines.md) — Integrates security validation steps directly into CI pipelines to block non-compliant infrastructure deployments. - [Vulnerability Data Collection](https://awesome-repositories.com/f/devops-infrastructure/container-registry-integrations/vulnerability-data-collection.md) — Retrieves known security vulnerabilities from container registries to augment infrastructure security reports. ### Testing & Quality Assurance - [Violation Suppression](https://awesome-repositories.com/f/testing-quality-assurance/general-testing-utilities/test-utilities-assertions/error-type-assertions/type-violation-detectors/violation-suppression.md) — Supports suppressing specific policy violations via configuration files or in-line annotations to reduce noise. ### Part of an Awesome List - [IaC Security](https://awesome-repositories.com/f/awesome-lists/devops/iac-security.md) — Static analyzer for infrastructure-as-code security. - [Infrastructure as Code Analysis](https://awesome-repositories.com/f/awesome-lists/devops/infrastructure-as-code-analysis.md) — Identifies security violations in cloud-native infrastructure code. - [Vulnerability Scanning](https://awesome-repositories.com/f/awesome-lists/security/vulnerability-scanning.md) — Detects compliance and security violations in infrastructure as code.