Infrastructure as code security
On this page
IaC review looks for security issues in infrastructure and CI configuration files included in an authorized source revision. It is a source review, not a live inventory of cloud accounts or proof that deployed resources match the files.
#Inputs
Choose the approved project source in Workbench. Configuration examples recognized in source review include Terraform, Dockerfiles, Helm, Kubernetes, GitHub Actions, GitLab CI, and Ansible. The files must be present in the selected source revision. See SAST languages and source files for source-file classification context.
#What results mean
A result points to configuration in the selected source. It does not establish that the configuration is active in a deployed environment or account. Deployment overrides, inherited settings, exceptions, and compensating controls can change the effective configuration.
#Review and remediation
Open the source evidence and confirm where the file is used, which environment it affects, and whether another policy or control changes its effect. Make approved changes in the relevant configuration, then review the source again. Verify deployed state separately when the decision depends on it.
#Availability
IaC is included in the Professional package. See Plans and licensing for package details. Access is arranged by email; request access.
#Related guides
Need a workflow that is not documented here? Email contact@eresussec.com.