accurics/terrascanArchived
Terrascan
Terrascan is an infrastructure as code security scanner and cloud configuration auditor designed to detect security violations and compliance risks in cloud templates and Dockerfiles before provisioning. It utilizes the Open Policy Agent to evaluate infrastructure templates against both standard security policies and custom organizational rules.
The project functions as a security guardrail within build pipelines, blocking risky deployments by integrating scanning logic directly into CI/CD workflows. It also includes a container registry vulnerability scanner that collects vulnerability data from registries to augment infrastructure security reports.
The toolset covers cloud compliance auditing, local development security testing, and policy enforcement. It provides a query language for defining custom security requirements and supports result suppression via configuration files to manage policy violations.
Scanning capabilities can be accessed through a command line interface or via a background API server for external orchestration.
Features
- Policy-Based Validations - Evaluates infrastructure configuration files against declarative logic and compliance rules using a policy engine.
- Infrastructure as Code Scanners - Provides a specialized tool for scanning cloud configuration files and Dockerfiles to detect security risks before provisioning.
- Policy Evaluation Engines - Utilizes the Open Policy Agent as an engine to evaluate infrastructure configurations against defined security policies and benchmarks.
- CI/CD Pipeline Integrations - Provides native support for automating security checks within continuous integration and deployment workflows.
- Security Scanning Integrations - Embeds vulnerability scanning into pipelines to enforce policy-based build failures and block risky deployments.
- Continuous Integration Pipelines - Integrates security validation steps directly into CI pipelines to block non-compliant infrastructure deployments.
- Cloud Infrastructure Security Auditors - Analyzes cloud resource configurations against security rules across multiple cloud providers.
- Cloud Compliance Auditors - Automates the evaluation of cloud infrastructure against regulatory frameworks and industry benchmarks.
- Compliance Policy Definitions - Uses a specialized query language to define organizational security and compliance requirements for infrastructure.
- Pipeline Policy Enforcement - Embeds security checks in CI/CD workflows to block risky deployments based on policy violations.
- Analysis Suppressions - Allows selectively ignoring specific rule violations using configuration files or annotations.
- Vulnerability Data Collection - Retrieves known security vulnerabilities from container registries to augment infrastructure security reports.
- Local Infrastructure Security Testing - Enables security checks during local build processes to identify and fix misconfigurations before committing code.
- Container Image Vulnerability Scanners - Analyzes container images and manifests for known OS and application-layer vulnerabilities.
- Violation Suppression - Supports suppressing specific policy violations via configuration files or in-line annotations to reduce noise.
- IaC Security - Static analyzer for infrastructure-as-code security.
- Infrastructure as Code Analysis - Identifies security violations in cloud-native infrastructure code.
- Vulnerability Scanning - Detects compliance and security violations in infrastructure as code.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
