tenable/terrascanArchived
Terrascan
Terrascan is a static analysis tool designed to evaluate infrastructure-as-code configuration files for security vulnerabilities and compliance violations. By parsing these files into an intermediate representation, it identifies risks before cloud resources are provisioned, serving as a compliance auditor for cloud-native environments.
The tool functions as a policy-as-code engine, allowing users to define and enforce custom security rules and industry benchmarks using a specialized query language. It distinguishes itself through its ability to integrate directly into development and deployment workflows, providing automated security guardrails that can block non-compliant deployments via exit-code-based reporting.
Beyond static analysis, the platform supports container registry vulnerability scanning to correlate image-based risks with infrastructure configurations. It also provides configuration drift monitoring to track provisioned resources against established security baselines, alongside configuration-driven suppression mechanisms to manage policy overrides and false positives.
The software offers both a command-line interface for local development validation and a network-accessible scanning API for remote integration with third-party systems and automated pipelines.
Features
- Static Configuration Analysis - Performs static analysis on infrastructure-as-code configuration files to identify security vulnerabilities and compliance violations without executing the code.
- Infrastructure as Code Scanners - A static analysis tool that evaluates infrastructure configuration files for security vulnerabilities and compliance violations before cloud resources are provisioned.
- Infrastructure as Code Security - Scans infrastructure-as-code files for security vulnerabilities and misconfigurations before provisioning.
- Infrastructure Policy Enforcement - Validates infrastructure-as-code configurations against security policies to ensure compliance before resources are provisioned.
- Infrastructure Policy Definition - Enables the definition of custom security rules and industry benchmarks using a specialized policy-as-code query language.
- Policy-As-Code Engines - Validates infrastructure configurations against security rules defined in a specialized query language.
- Local Development Tools - Enables security testing of infrastructure configurations during local development build processes.
- Remote Scanning APIs - Exposes security analysis logic through network-accessible endpoints for remote integration with automated workflows.
- Programmable Scan Interfaces - Provides programmable interfaces for external systems to trigger security scans and retrieve analysis results.
- CI/CD Pipeline Integrations - Integrates security guardrails directly into delivery pipelines to ensure compliance throughout the deployment lifecycle.
- Policy Suppressions - Enables selective disabling or overriding of security rules via external configuration files to manage false positives.
- GitOps Workflows - Connects code repositories and build processes to automated scanning tools within GitOps workflows.
- Infrastructure Monitoring & Configuration - Tracks provisioned cloud infrastructure for configuration drift against established security baselines to identify unauthorized modifications.
- Cloud Auditing Tools - Evaluates cloud configurations against security policies to identify risks and monitor for configuration drift.
- Cloud Compliance Auditors - Monitors infrastructure posture and container images to ensure continuous adherence to regulatory standards.
- Local Infrastructure Security Testing - Provides local security testing for infrastructure code to identify configuration errors before committing changes.
- Pipeline Security Tools - Integrates security scanning into CI/CD workflows to automatically block non-compliant infrastructure deployments.
- Security Automation Integrations - Embeds automated security checks into CI/CD workflows to enforce guardrails and block non-compliant deployments.
- Vulnerability Aggregators - Collects and correlates vulnerability data from container registries to assess infrastructure risk.
- Container Image Vulnerability Scanners - Scans container registries to correlate image-based vulnerabilities with infrastructure configurations.
- Exit Code Pipeline Mappings - Maps scan results to specific exit codes to automate pipeline decisions like blocking or allowing deployments.
- Workflow Automation - Static code analysis for security.
- Workflow Utilities - Security and best practice scanner for IaC.
