Infrastructure as Code (IaC) Scanning

Overview

Infrastructure as Code (IaC) scanning checks your infrastructure configuration files for security problems before you deploy. Shieldome supports five IaC formats and auto-detects the correct scanner based on file name and content.

🏗️

No cloud credentials needed. IaC scanning is purely static: Shieldome reads the configuration files you upload and never connects to AWS, GCP, Azure, or any cloud provider.

Supported formats

Format	File types
Terraform	`.tf`, `.tfvars`
Kubernetes	`.yaml`, `.yml` with `apiVersion:`
CloudFormation	`.json`, `.yaml` with `AWSTemplateFormatVersion`
Docker Compose	`docker-compose.yml`, `docker-compose.yaml`
Dockerfile	Any file named `Dockerfile` or `Dockerfile.*`

Checks by format

Terraform

Security groups open to 0.0.0.0/0 (all traffic)
Encryption disabled on EBS volumes, RDS instances, S3 buckets
RDS / databases marked publicly_accessible = true
Hardcoded secrets in resource or variable blocks
Missing tags on resources (ownership/cost attribution)
S3 bucket public ACL or public policy
CloudTrail logging disabled

Kubernetes

Containers running with privileged: true
Containers running as root (runAsUser: 0 or no runAsNonRoot)
No resource limits (CPU / memory) - can cause noisy-neighbour DoS
No liveness or readiness probe - Kubernetes cannot detect unhealthy pods
Hardcoded secrets in environment variable definitions
Host network or host PID namespace sharing

CloudFormation

RDS instances without storage encryption or deletion protection
S3 buckets without versioning, logging, or public access blocking
EC2 security groups with unrestricted ingress
IAM roles or policies with overly permissive actions (*)

Docker Compose

privileged: true on any service
network_mode: host or pid: host
Hardcoded secrets in environment blocks
Sensitive host paths mounted into containers (/etc, /var/run/docker.sock)

How to run an IaC scan

In the app sidebar, click IaC Scan
Drag and drop one or more IaC files (or a ZIP archive) into the upload area
Click Scan Files
Results are grouped by file and sorted by severity

📁

ZIP upload. You can upload a ZIP file containing multiple IaC files. Shieldome will unzip and scan all supported files in one request. Maximum 80 files per scan.

API

# Scan a single Terraform file
curl -X POST https://app.shieldome.com/api/iac-scan \
  -H "X-Shieldome-Key: YOUR_API_KEY" \
  -F "files=@./main.tf"

# Scan a ZIP archive
curl -X POST https://app.shieldome.com/api/iac-scan \
  -H "X-Shieldome-Key: YOUR_API_KEY" \
  -F "files=@./infra.zip"

Integrating into CI/CD

Run IaC scanning in your pipeline to catch misconfigurations before they are applied:

# GitHub Actions example
- name: IaC Security Scan
  run: |
    zip -r infra.zip terraform/
    curl -X POST https://app.shieldome.com/api/iac-scan \
      -H "X-Shieldome-Key: ${{ secrets.SHIELDOME_API_KEY }}" \
      -F "files=@./infra.zip" \
      -o results.json
    # Fail the build if critical findings exist
    python3 -c "
    import json, sys
    r = json.load(open('results.json'))
    if r.get('summary', {}).get('critical', 0) > 0:
        sys.exit(1)
    "