Scan your infrastructure as code like Code!

The talk argues that cloud infrastructure defined as code deserves the same static scanning that application code already gets. Misconfigurations such as publicly readable storage buckets, unencrypted volumes and databases protected only by a password are a common source of breaches, and the speaker stresses that catching them before code is committed costs far less than fixing them after a deployment goes live.

The speaker focuses on Terraform and demonstrates Checkov, an open-source scanner under the Apache 2.0 license that also covers other formats such as Helm, Kubernetes manifests and Dockerfiles. Running it on a directory requires no configuration, and findings point to the exact file, line and resource. He shows how to suppress a single check with an inline comment when a resource has a valid reason to differ, how to create a baseline so legacy findings are set aside while new ones still appear, and how to export command-line options into a config file. He also covers pre-commit hooks and CI pipelines, where failed checks can block a commit or merge, and briefly mentions the commercial offering built on the same project and HashiCorp Sentinel for policy as code.

The main takeaway is to start with a few high-impact checks, such as open SSH and RDP ports, public storage and database access, and missing encryption, and to run them as early as possible. Stylistic checks can be tuned deliberately through skips or baselines rather than ignored, so the scanner stays trusted by the developers who rely on it.