What is IaC compliance scanning?
IaC compliance scanning is automated inspection of infrastructure-as-code sources or plans, such as Terraform HCL or plan JSON, that flags settings violating security or compliance rules before the infrastructure is deployed.
How it works
Each run starts from one of two inputs:
| Input | When it runs | Strength | Weakness |
|---|---|---|---|
| Source files (HCL) | Before terraform init | Quick, needs no credentials, works in a pre-commit hook | Cannot see values known only after planning |
Plan JSON (terraform show -json) | After terraform plan | Sees the values known at plan time | A plan must exist first, which usually needs cloud credentials; values known only after apply stay unknown |
A run reports findings in a format such as SARIF, JSON or JUnit. By itself that output stops nothing; the build fails only when a CI step, a policy engine, or a code-scanning gate says so. Checkov and Trivy are common open-source options. Both parse Terraform plus CloudFormation, Kubernetes manifests, and Dockerfiles, and their bundled rules cover frequently used resource types, not all types.
Scanning counts as a detective control: it exposes an issue inside a change, yet it does not prevent that issue from being written.
How compliance.tf applies it
Compliance.tf modules block misconfiguration in the resources they create; a scanner reviews everything else, so run both.
ctfkit is the CI checker from compliance.tf. It executes the same Terraform and OpenTofu checks in a pre-commit hook, GitHub Actions, Spacelift, or a plain shell. If a finding matches a gap that a compliance.tf module would close, the finding names that module's source. Its checks, scan, report and verify-lock, make no network connection, read no cloud credentials, and never invoke terraform or tofu.
ctfkit scan --stage pre_plan ./infra # source, before init
ctfkit scan plan.json --format sarif --out findings.sarif # plan JSON, for code scanningctfkit is Apache-2.0 licensed, and you don't need an account to download its releases. The reference analyzers page tells you the current coverage.