The IaC scanner catches security misconfigurations in your infrastructure code before they get applied. Think of it as a CSPM scan for resources that don’t exist yet.

​
What it scans

FormatWhat we look at
Terraform*.tf and *.tf.json files
CloudFormationYAML / JSON templates
Kubernetes*.yaml / *.yml manifests
Helm chartsChart templates + values files
DockerfileDockerfile, *.dockerfile
Azure ARMJSON templates
IaC scanning uses TigerGate’s misconfiguration engine. It auto-detects the config formats above in your working tree and applies a built-in policy set of misconfiguration checks, mapped to TigerGate’s finding model and severities.

​
Common findings

​
AWS / Terraform

  • S3 bucket without server-side encryption
  • S3 bucket with public-read ACL
  • Security group allowing 0.0.0.0/0 to port 22 / 3389 / 5432 / 27017
  • IAM policy with Action: * on Resource: *
  • RDS instance without encryption-at-rest
  • KMS key without rotation
  • CloudTrail not configured for multi-region

​
Kubernetes

  • Pod running as root (runAsUser: 0 or unset)
  • Privileged container (securityContext.privileged: true)
  • Pod with hostNetwork / hostPID / hostIPC: true
  • Pod with no resources.limits → no QoS guarantees
  • Service of type LoadBalancer with no source-IP allow-list
  • Default service account being used (automountServiceAccountToken not set to false)
  • Missing readOnlyRootFilesystem: true
  • Capabilities not dropped (capabilities.drop: [ALL] missing)

​
Dockerfile

  • USER root (or no USER directive — defaults to root)
  • No HEALTHCHECK
  • :latest tag (or no tag) on FROM — non-deterministic builds
  • apt-get install without --no-install-recommends
  • Sensitive ports exposed (22, 3389, 23, 21)
  • ADD from a remote URL (use wget + verify checksum instead)

​
Excluding paths

By default the scan walks the whole working tree. To skip directories (archived or vendored IaC, generated manifests, …), use the CLI’s --exclude flag or the org/repo exclude paths config that CI scans read: 
tigergate scan --type iac --exclude "terraform/_archive/,k8s/legacy/" --upload
The exclude list is comma-separated and applies to SAST and IaC scans alike.

​
Suppressing findings

In the dashboard — open the finding’s side panel and set its status dropdown to Accepted (Risk) (or Won’t Fix / False Positive). To skip whole paths at scan time, use --exclude.

​
Custom rules

IaC checks come from TigerGate’s built-in policy set. Custom user-authored IaC rules aren’t exposed in the dashboard today — custom-rule authoring is currently a SAST feature (see SAST rule writing).

​
Running IaC scans

Run IaC on its own or as part of a full scan. The CLI evaluates the IaC files in the working tree (Terraform, Kubernetes, Dockerfiles, Helm, CloudFormation): 
# IaC only
tigergate scan --type iac --upload

# IaC as part of the full suite (SAST + SCA + secrets + quality + IaC)
tigergate scan --type all --upload
Findings are grouped under the dashboard’s IaC view and counted separately from SAST.