[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71CK3TBTHDBAM1M67SR1K8B":3,"skill-same:01M71CK3TBTHDBAM1M67SR1K8B":99},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":72,"commitSha":73,"skillDirectory":74,"forksCount":14,"repositoryHtmlUrl":75,"repositoryHomepageUrl":6,"ownerHtmlUrl":76,"ownerBlogUrl":6,"ownerDescription":77,"updatedAt":78,"install":79,"resources":92},"01M71CK3TBTHDBAM1M67SR1K8B","infrastructure-terraform-audit",null,"Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA\u002FRego policies to detect overly permissive IAM policies, public resource exposure, missing encryption, and insecure defaults before cloud deployment.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Finfrastructure\u002Fterraform\u002Faudit\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"audit","infrastructure","infrastructure terraform audit","terraform","infrastructure terraform","as","sonnet","security","terraform infrastructure","read","cloud-security","de","iam","code","encryption","Bash","cybersecurity","infrastructure-as","cm","opa","2026-11-10 10:12:30",false,"---\nname: infrastructure-terraform-audit\ndescription: Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA\u002FRego policies to detect overly permissive IAM policies, public resource exposure, missing encryption, and insecure defaults before cloud deployment.\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- cloud-security\n- terraform\n- infrastructure-as-code\n- checkov\n- tfsec\n- policy-as-code\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1046\ncapec: []\n---\n\n# Auditing Terraform Infrastructure for Security\n\n## When to Use\n\n- When integrating security scanning into CI\u002FCD pipelines for Terraform deployments\n- When reviewing Terraform plans and modules for security best practices before applying\n- When building policy-as-code guardrails for cloud infrastructure provisioning\n- When auditing existing Terraform state files to identify deployed misconfigurations\n- When enforcing organizational security standards across multiple Terraform projects\n\n**Do not use** for runtime security monitoring (use CSPM tools), for application security testing (use SAST\u002FDAST tools), or for cloud configuration drift detection (use AWS Config or Azure Policy after deployment).\n\n## Prerequisites\n\n- Checkov installed (`pip install checkov`)\n- tfsec installed (`brew install tfsec` or binary from GitHub)\n- Terrascan installed (`brew install terrascan`)\n- Terraform v1.0+ for plan generation\n- OPA (Open Policy Agent) for custom policy enforcement\n- Git repository with Terraform code to audit\n\n## Workflow\n\n### Step 1: Scan Terraform Code with Checkov\n\nRun Checkov for comprehensive IaC security scanning with built-in and custom policies.\n\n```bash\n# Scan a Terraform directory\ncheckov -d .\u002Fterraform\u002F --framework terraform\n\n# Scan with specific check categories\ncheckov -d .\u002Fterraform\u002F --check CKV_AWS_18,CKV_AWS_19,CKV_AWS_20,CKV_AWS_21\n\n# Scan and output results in JSON\ncheckov -d .\u002Fterraform\u002F --output json > checkov-results.json\n\n# Scan a Terraform plan file for more accurate analysis\nterraform init && terraform plan -out=tfplan\nterraform show -json tfplan > tfplan.json\ncheckov -f tfplan.json --framework terraform_plan\n\n# Skip specific checks with justification\ncheckov -d .\u002Fterraform\u002F --skip-check CKV_AWS_145 \\\n  --bc-api-key $BRIDGECREW_API_KEY\n\n# Scan Terraform modules\ncheckov -d .\u002Fmodules\u002F --framework terraform --compact\n\n# List all available checks\ncheckov --list --framework terraform | grep CKV_AWS\n```\n\n### Step 2: Scan with tfsec for Terraform-Specific Issues\n\nUse tfsec for Terraform-native security analysis with detailed remediation guidance.\n\n```bash\n# Scan a Terraform directory\ntfsec .\u002Fterraform\u002F\n\n# Scan with minimum severity threshold\ntfsec .\u002Fterraform\u002F --minimum-severity HIGH\n\n# Output in JSON for CI\u002FCD processing\ntfsec .\u002Fterraform\u002F --format json > tfsec-results.json\n\n# Scan with custom checks\ntfsec .\u002Fterraform\u002F --custom-check-dir .\u002Fcustom-checks\u002F\n\n# Exclude specific rules\ntfsec .\u002Fterraform\u002F --exclude-downloaded-modules \\\n  --exclude aws-s3-enable-bucket-logging\n\n# Scan and fail on specific severity\ntfsec .\u002Fterraform\u002F --minimum-severity CRITICAL --soft-fail\n\n# Generate SARIF output for GitHub Security tab\ntfsec .\u002Fterraform\u002F --format sarif > tfsec.sarif\n```\n\n### Step 3: Run Terrascan for Multi-Framework Compliance\n\nExecute Terrascan for compliance checking against CIS, NIST, and SOC 2 frameworks.\n\n```bash\n# Scan Terraform against CIS AWS benchmark\nterrascan scan -t aws -i terraform -d .\u002Fterraform\u002F \\\n  --policy-type aws --verbose\n\n# Scan against specific compliance frameworks\nterrascan scan -t aws -i terraform -d .\u002Fterraform\u002F \\\n  --policy-type aws \\\n  --categories \"Compliance Validation\"\n\n# Output in JSON\nterrascan scan -t aws -i terraform -d .\u002Fterraform\u002F \\\n  --output json > terrascan-results.json\n\n# Scan a Terraform plan\nterrascan scan -t aws -i terraform \\\n  --iac-file tfplan.json \\\n  --iac-type tfplan\n\n# List available policies\nterrascan scan --list-policies -t aws\n```\n\n### Step 4: Create Custom OPA Policies for Organization Standards\n\nWrite Rego policies for organization-specific security requirements.\n\n```rego\n# policy\u002Faws_s3_encryption.rego\npackage terraform.aws.s3\n\ndeny[msg] {\n    resource := input.resource.aws_s3_bucket[name]\n    not resource.server_side_encryption_configuration\n    msg := sprintf(\"S3 bucket '%s' must have server-side encryption enabled\", [name])\n}\n\n# policy\u002Faws_iam_no_wildcards.rego\npackage terraform.aws.iam\n\ndeny[msg] {\n    resource := input.resource.aws_iam_policy[name]\n    statement := resource.policy.Statement[_]\n    statement.Action == \"*\"\n    statement.Effect == \"Allow\"\n    msg := sprintf(\"IAM policy '%s' must not use wildcard (*) actions\", [name])\n}\n\ndeny[msg] {\n    resource := input.resource.aws_iam_policy[name]\n    statement := resource.policy.Statement[_]\n    statement.Resource == \"*\"\n    statement.Effect == \"Allow\"\n    contains(statement.Action[_], \"*\")\n    msg := sprintf(\"IAM policy '%s' has overly permissive actions on wildcard resources\", [name])\n}\n\n# policy\u002Faws_no_public_ingress.rego\npackage terraform.aws.security_group\n\ndeny[msg] {\n    resource := input.resource.aws_security_group_rule[name]\n    resource.type == \"ingress\"\n    resource.cidr_blocks[_] == \"0.0.0.0\u002F0\"\n    resource.from_port \u003C= 22\n    resource.to_port >= 22\n    msg := sprintf(\"Security group rule '%s' allows SSH from 0.0.0.0\u002F0\", [name])\n}\n```\n\n```bash\n# Evaluate Terraform plan against OPA policies\nterraform show -json tfplan | opa eval \\\n  --data .\u002Fpolicy\u002F \\\n  --input \u002Fdev\u002Fstdin \\\n  \"data.terraform.aws\" \\\n  --format pretty\n\n# Run Conftest for easier OPA policy testing\nconftest test tfplan.json --policy .\u002Fpolicy\u002F --output json\n```\n\n### Step 5: Integrate Security Scanning into CI\u002FCD Pipeline\n\nAdd IaC security scanning as a mandatory CI\u002FCD gate.\n\n```yaml\n# GitHub Actions: Terraform security pipeline\nname: infrastructure-terraform-audit\non:\n  pull_request:\n    paths: ['terraform\u002F**']\n\njobs:\n  security-scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Setup Terraform\n        uses: hashicorp\u002Fsetup-terraform@v3\n\n      - name: Terraform Init & Plan\n        run: |\n          cd terraform\u002F\n          terraform init\n          terraform plan -out=tfplan\n          terraform show -json tfplan > tfplan.json\n\n      - name: Checkov Scan\n        uses: bridgecrewio\u002Fcheckov-action@master\n        with:\n          directory: terraform\u002F\n          framework: terraform\n          output_format: sarif\n          output_file_path: checkov.sarif\n          soft_fail: false\n\n      - name: tfsec Scan\n        uses: aquasecurity\u002Ftfsec-action@v1.0.0\n        with:\n          working_directory: terraform\u002F\n          soft_fail: false\n\n      - name: Upload SARIF\n        uses: github\u002Fcodeql-action\u002Fupload-sarif@v2\n        with:\n          sarif_file: checkov.sarif\n\n      - name: OPA Policy Check\n        run: |\n          conftest test terraform\u002Ftfplan.json \\\n            --policy .\u002Fpolicy\u002F \\\n            --output json\n```\n\n### Step 6: Scan Terraform State for Deployed Misconfigurations\n\nAudit the current Terraform state to identify already-deployed security issues.\n\n```bash\n# Export current state as JSON\nterraform show -json > terraform-state.json\n\n# Scan the state with Checkov\ncheckov -f terraform-state.json --framework terraform_plan\n\n# Query state for specific security issues\nterraform state list | while read resource; do\n  terraform state show \"$resource\" 2>\u002Fdev\u002Fnull | grep -i \"public\\|0.0.0.0\\|encrypt.*false\\|password\"\ndone\n\n# Find resources without required tags\nterraform state list | grep aws_instance | while read resource; do\n  tags=$(terraform state show \"$resource\" | grep -A20 \"tags\")\n  if ! echo \"$tags\" | grep -q \"Environment\"; then\n    echo \"MISSING TAG: $resource lacks 'Environment' tag\"\n  fi\ndone\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Infrastructure as Code | Practice of managing cloud infrastructure through declarative configuration files (Terraform, CloudFormation) rather than manual console operations |\n| Policy as Code | Expressing security and compliance policies as executable code (Rego, Python) that can be automatically evaluated against infrastructure definitions |\n| Shift Left Security | Moving security checks earlier in the development lifecycle by scanning IaC before deployment rather than auditing after provisioning |\n| Terraform Plan | Preview of changes Terraform will make, which can be exported as JSON for security scanning before applying changes |\n| Checkov | Open-source static analysis tool for IaC supporting Terraform, CloudFormation, Kubernetes, and Docker with 1000+ built-in policies |\n| OPA\u002FRego | Open Policy Agent and its policy language Rego for defining custom security rules that evaluate against structured data inputs |\n\n## Tools & Systems\n\n- **Checkov**: Comprehensive IaC scanner with 1000+ policies for Terraform, CloudFormation, Kubernetes, ARM, and Dockerfile\n- **tfsec**: Terraform-specific static analysis tool with detailed remediation guidance and SARIF output\n- **Terrascan**: Multi-IaC scanner supporting compliance frameworks (CIS, NIST, SOC 2) with policy-as-code\n- **OPA\u002FConftest**: Custom policy engine for defining organization-specific security rules using Rego language\n- **Bridgecrew**: Commercial platform built on Checkov providing drift detection and supply chain security\n\n## Common Scenarios\n\n### Scenario: Adding Security Gates to an Existing Terraform CI\u002FCD Pipeline\n\n**Context**: A DevOps team deploys infrastructure via Terraform in GitHub Actions but has no security scanning. Recent audit findings show multiple S3 buckets without encryption and security groups allowing SSH from the internet.\n\n**Approach**:\n1. Add Checkov as the first security gate in the GitHub Actions workflow\n2. Run `checkov -d .\u002Fterraform\u002F` to establish the current baseline of findings\n3. Triage existing findings: fix CRITICAL issues, create tickets for HIGH, suppress accepted risks\n4. Add tfsec as a secondary scanner for Terraform-specific checks\n5. Write custom OPA policies for organization standards (required tags, naming conventions)\n6. Configure the pipeline to block PRs with CRITICAL or HIGH findings\n7. Generate SARIF reports for GitHub Security tab integration\n\n**Pitfalls**: Adding security scanning to an existing project will initially produce hundreds of findings. Implement gradually by starting with CRITICAL-only blocking, then expanding to HIGH. Use inline suppression comments (`#checkov:skip=CKV_AWS_18:Public bucket for static website`) for intentional exceptions with documented justification.\n\n## Output Format\n\n```\nTerraform Security Audit Report\n==================================\nRepository: acme-corp\u002Finfrastructure\nBranch: main\nScan Date: 2026-02-23\nTools: Checkov 3.x, tfsec 1.x, OPA custom policies\n\nSCAN RESULTS:\n  Checkov checks passed:    187\n  Checkov checks failed:     34\n  tfsec checks passed:      156\n  tfsec checks failed:       28\n  OPA custom policies:       12 passed, 3 failed\n\nCRITICAL FINDINGS:\n[TF-001] S3 Bucket Without Encryption\n  File: modules\u002Fstorage\u002Fmain.tf:24\n  Resource: aws_s3_bucket.data_lake\n  Check: CKV_AWS_19\n  Fix: Add server_side_encryption_configuration block\n\n[TF-002] Security Group Allows SSH from 0.0.0.0\u002F0\n  File: modules\u002Fnetwork\u002Fsecurity.tf:45\n  Resource: aws_security_group_rule.ssh_access\n  Check: CKV_AWS_24\n  Fix: Restrict cidr_blocks to bastion subnet\n\n[TF-003] IAM Policy with Wildcard Actions\n  File: modules\u002Fiam\u002Fpolicies.tf:12\n  Resource: aws_iam_policy.developer_policy\n  Check: CKV_AWS_1\n  Fix: Scope actions to specific services required\n\nSUMMARY BY SEVERITY:\n  Critical:  6 findings\n  High:     14 findings\n  Medium:   28 findings\n  Low:      18 findings\n  Info:     12 findings\n```\n","# Auditing Terraform Infrastructure for Security\n\n## When to Use\n\n- When integrating security scanning into CI\u002FCD pipelines for Terraform deployments\n- When reviewing Terraform plans and modules for security best practices before applying\n- When building policy-as-code guardrails for cloud infrastructure provisioning\n- When auditing existing Terraform state files to identify deployed misconfigurations\n- When enforcing organizational security standards across multiple Terraform projects\n\n**Do not use** for runtime security monitoring (use CSPM tools), for application security testing (use SAST\u002FDAST tools), or for cloud configuration drift detection (use AWS Config or Azure Policy after deployment).\n\n## Prerequisites\n\n- Checkov installed (`pip install checkov`)\n- tfsec installed (`brew install tfsec` or binary from GitHub)\n- Terrascan installed (`brew install terrascan`)\n- Terraform v1.0+ for plan generation\n- OPA (Open Policy Agent) for custom policy enforcement\n- Git repository with Terraform code to audit\n\n## Workflow\n\n### Step 1: Scan Terraform Code with Checkov\n\nRun Checkov for comprehensive IaC security scanning with built-in and custom policies.\n\n```bash\n# Scan a Terraform directory\ncheckov -d .\u002Fterraform\u002F --framework terraform\n\n# Scan with specific check categories\ncheckov -d .\u002Fterraform\u002F --check CKV_AWS_18,CKV_AWS_19,CKV_AWS_20,CKV_AWS_21\n\n# Scan and output results in JSON\ncheckov -d .\u002Fterraform\u002F --output json > checkov-results.json\n\n# Scan a Terraform plan file for more accurate analysis\nterraform init && terraform plan -out=tfplan\nterraform show -json tfplan > tfplan.json\ncheckov -f tfplan.json --framework terraform_plan\n\n# Skip specific checks with justification\ncheckov -d .\u002Fterraform\u002F --skip-check CKV_AWS_145 \\\n  --bc-api-key $BRIDGECREW_API_KEY\n\n# Scan Terraform modules\ncheckov -d .\u002Fmodules\u002F --framework terraform --compact\n\n# List all available checks\ncheckov --list --framework terraform | grep CKV_AWS\n```\n\n### Step 2: Scan with tfsec for Terraform-Specific Issues\n\nUse tfsec for Terraform-native security analysis with detailed remediation guidance.\n\n```bash\n# Scan a Terraform directory\ntfsec .\u002Fterraform\u002F\n\n# Scan with minimum severity threshold\ntfsec .\u002Fterraform\u002F --minimum-severity HIGH\n\n# Output in JSON for CI\u002FCD processing\ntfsec .\u002Fterraform\u002F --format json > tfsec-results.json\n\n# Scan with custom checks\ntfsec .\u002Fterraform\u002F --custom-check-dir .\u002Fcustom-checks\u002F\n\n# Exclude specific rules\ntfsec .\u002Fterraform\u002F --exclude-downloaded-modules \\\n  --exclude aws-s3-enable-bucket-logging\n\n# Scan and fail on specific severity\ntfsec .\u002Fterraform\u002F --minimum-severity CRITICAL --soft-fail\n\n# Generate SARIF output for GitHub Security tab\ntfsec .\u002Fterraform\u002F --format sarif > tfsec.sarif\n```\n\n### Step 3: Run Terrascan for Multi-Framework Compliance\n\nExecute Terrascan for compliance checking against CIS, NIST, and SOC 2 frameworks.\n\n```bash\n# Scan Terraform against CIS AWS benchmark\nterrascan scan -t aws -i terraform -d .\u002Fterraform\u002F \\\n  --policy-type aws --verbose\n\n# Scan against specific compliance frameworks\nterrascan scan -t aws -i terraform -d .\u002Fterraform\u002F \\\n  --policy-type aws \\\n  --categories \"Compliance Validation\"\n\n# Output in JSON\nterrascan scan -t aws -i terraform -d .\u002Fterraform\u002F \\\n  --output json > terrascan-results.json\n\n# Scan a Terraform plan\nterrascan scan -t aws -i terraform \\\n  --iac-file tfplan.json \\\n  --iac-type tfplan\n\n# List available policies\nterrascan scan --list-policies -t aws\n```\n\n### Step 4: Create Custom OPA Policies for Organization Standards\n\nWrite Rego policies for organization-specific security requirements.\n\n```rego\n# policy\u002Faws_s3_encryption.rego\npackage terraform.aws.s3\n\ndeny[msg] {\n    resource := input.resource.aws_s3_bucket[name]\n    not resource.server_side_encryption_configuration\n    msg := sprintf(\"S3 bucket '%s' must have server-side encryption enabled\", [name])\n}\n\n# policy\u002Faws_iam_no_wildcards.rego\npackage terraform.aws.iam\n\ndeny[msg] {\n    resource := input.resource.aws_iam_policy[name]\n    statement := resource.policy.Statement[_]\n    statement.Action == \"*\"\n    statement.Effect == \"Allow\"\n    msg := sprintf(\"IAM policy '%s' must not use wildcard (*) actions\", [name])\n}\n\ndeny[msg] {\n    resource := input.resource.aws_iam_policy[name]\n    statement := resource.policy.Statement[_]\n    statement.Resource == \"*\"\n    statement.Effect == \"Allow\"\n    contains(statement.Action[_], \"*\")\n    msg := sprintf(\"IAM policy '%s' has overly permissive actions on wildcard resources\", [name])\n}\n\n# policy\u002Faws_no_public_ingress.rego\npackage terraform.aws.security_group\n\ndeny[msg] {\n    resource := input.resource.aws_security_group_rule[name]\n    resource.type == \"ingress\"\n    resource.cidr_blocks[_] == \"0.0.0.0\u002F0\"\n    resource.from_port \u003C= 22\n    resource.to_port >= 22\n    msg := sprintf(\"Security group rule '%s' allows SSH from 0.0.0.0\u002F0\", [name])\n}\n```\n\n```bash\n# Evaluate Terraform plan against OPA policies\nterraform show -json tfplan | opa eval \\\n  --data .\u002Fpolicy\u002F \\\n  --input \u002Fdev\u002Fstdin \\\n  \"data.terraform.aws\" \\\n  --format pretty\n\n# Run Conftest for easier OPA policy testing\nconftest test tfplan.json --policy .\u002Fpolicy\u002F --output json\n```\n\n### Step 5: Integrate Security Scanning into CI\u002FCD Pipeline\n\nAdd IaC security scanning as a mandatory CI\u002FCD gate.\n\n```yaml\n# GitHub Actions: Terraform security pipeline\nname: infrastructure-terraform-audit\non:\n  pull_request:\n    paths: ['terraform\u002F**']\n\njobs:\n  security-scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Setup Terraform\n        uses: hashicorp\u002Fsetup-terraform@v3\n\n      - name: Terraform Init & Plan\n        run: |\n          cd terraform\u002F\n          terraform init\n          terraform plan -out=tfplan\n          terraform show -json tfplan > tfplan.json\n\n      - name: Checkov Scan\n        uses: bridgecrewio\u002Fcheckov-action@master\n        with:\n          directory: terraform\u002F\n          framework: terraform\n          output_format: sarif\n          output_file_path: checkov.sarif\n          soft_fail: false\n\n      - name: tfsec Scan\n        uses: aquasecurity\u002Ftfsec-action@v1.0.0\n        with:\n          working_directory: terraform\u002F\n          soft_fail: false\n\n      - name: Upload SARIF\n        uses: github\u002Fcodeql-action\u002Fupload-sarif@v2\n        with:\n          sarif_file: checkov.sarif\n\n      - name: OPA Policy Check\n        run: |\n          conftest test terraform\u002Ftfplan.json \\\n            --policy .\u002Fpolicy\u002F \\\n            --output json\n```\n\n### Step 6: Scan Terraform State for Deployed Misconfigurations\n\nAudit the current Terraform state to identify already-deployed security issues.\n\n```bash\n# Export current state as JSON\nterraform show -json > terraform-state.json\n\n# Scan the state with Checkov\ncheckov -f terraform-state.json --framework terraform_plan\n\n# Query state for specific security issues\nterraform state list | while read resource; do\n  terraform state show \"$resource\" 2>\u002Fdev\u002Fnull | grep -i \"public\\|0.0.0.0\\|encrypt.*false\\|password\"\ndone\n\n# Find resources without required tags\nterraform state list | grep aws_instance | while read resource; do\n  tags=$(terraform state show \"$resource\" | grep -A20 \"tags\")\n  if ! echo \"$tags\" | grep -q \"Environment\"; then\n    echo \"MISSING TAG: $resource lacks 'Environment' tag\"\n  fi\ndone\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Infrastructure as Code | Practice of managing cloud infrastructure through declarative configuration files (Terraform, CloudFormation) rather than manual console operations |\n| Policy as Code | Expressing security and compliance policies as executable code (Rego, Python) that can be automatically evaluated against infrastructure definitions |\n| Shift Left Security | Moving security checks earlier in the development lifecycle by scanning IaC before deployment rather than auditing after provisioning |\n| Terraform Plan | Preview of changes Terraform will make, which can be exported as JSON for security scanning before applying changes |\n| Checkov | Open-source static analysis tool for IaC supporting Terraform, CloudFormation, Kubernetes, and Docker with 1000+ built-in policies |\n| OPA\u002FRego | Open Policy Agent and its policy language Rego for defining custom security rules that evaluate against structured data inputs |\n\n## Tools & Systems\n\n- **Checkov**: Comprehensive IaC scanner with 1000+ policies for Terraform, CloudFormation, Kubernetes, ARM, and Dockerfile\n- **tfsec**: Terraform-specific static analysis tool with detailed remediation guidance and SARIF output\n- **Terrascan**: Multi-IaC scanner supporting compliance frameworks (CIS, NIST, SOC 2) with policy-as-code\n- **OPA\u002FConftest**: Custom policy engine for defining organization-specific security rules using Rego language\n- **Bridgecrew**: Commercial platform built on Checkov providing drift detection and supply chain security\n\n## Common Scenarios\n\n### Scenario: Adding Security Gates to an Existing Terraform CI\u002FCD Pipeline\n\n**Context**: A DevOps team deploys infrastructure via Terraform in GitHub Actions but has no security scanning. Recent audit findings show multiple S3 buckets without encryption and security groups allowing SSH from the internet.\n\n**Approach**:\n1. Add Checkov as the first security gate in the GitHub Actions workflow\n2. Run `checkov -d .\u002Fterraform\u002F` to establish the current baseline of findings\n3. Triage existing findings: fix CRITICAL issues, create tickets for HIGH, suppress accepted risks\n4. Add tfsec as a secondary scanner for Terraform-specific checks\n5. Write custom OPA policies for organization standards (required tags, naming conventions)\n6. Configure the pipeline to block PRs with CRITICAL or HIGH findings\n7. Generate SARIF reports for GitHub Security tab integration\n\n**Pitfalls**: Adding security scanning to an existing project will initially produce hundreds of findings. Implement gradually by starting with CRITICAL-only blocking, then expanding to HIGH. Use inline suppression comments (`#checkov:skip=CKV_AWS_18:Public bucket for static website`) for intentional exceptions with documented justification.\n\n## Output Format\n\n```\nTerraform Security Audit Report\n==================================\nRepository: acme-corp\u002Finfrastructure\nBranch: main\nScan Date: 2026-02-23\nTools: Checkov 3.x, tfsec 1.x, OPA custom policies\n\nSCAN RESULTS:\n  Checkov checks passed:    187\n  Checkov checks failed:     34\n  tfsec checks passed:      156\n  tfsec checks failed:       28\n  OPA custom policies:       12 passed, 3 failed\n\nCRITICAL FINDINGS:\n[TF-001] S3 Bucket Without Encryption\n  File: modules\u002Fstorage\u002Fmain.tf:24\n  Resource: aws_s3_bucket.data_lake\n  Check: CKV_AWS_19\n  Fix: Add server_side_encryption_configuration block\n\n[TF-002] Security Group Allows SSH from 0.0.0.0\u002F0\n  File: modules\u002Fnetwork\u002Fsecurity.tf:45\n  Resource: aws_security_group_rule.ssh_access\n  Check: CKV_AWS_24\n  Fix: Restrict cidr_blocks to bastion subnet\n\n[TF-003] IAM Policy with Wildcard Actions\n  File: modules\u002Fiam\u002Fpolicies.tf:12\n  Resource: aws_iam_policy.developer_policy\n  Check: CKV_AWS_1\n  Fix: Scope actions to specific services required\n\nSUMMARY BY SEVERITY:\n  Critical:  6 findings\n  High:     14 findings\n  Medium:   28 findings\n  Low:      18 findings\n  Info:     12 findings\n```\n",{"name":5,"tags":54,"capec":59,"model":35,"tools":60,"domain":45,"maxTurns":64,"nist_csf":65,"subdomain":39,"description":7,"mitre_attack":70},[39,32,55,56,57,58],"infrastructure-as-code","checkov","tfsec","policy-as-code",[],[61,44,62,63],"Read","Glob","Grep",20,[66,67,68,69],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01",[71],"T1046","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud\u002Finfrastructure\u002Fterraform\u002Faudit","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":80,"prompt":90,"zipAvailable":91},[81,84,87],{"tool":82,"command":83},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill infrastructure-terraform-audit",{"tool":85,"command":86},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill infrastructure-terraform-audit",{"tool":88,"command":89},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill infrastructure-terraform-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Finfrastructure\u002Fterraform\u002Faudit\u002FSKILL.md",true,[93],{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"index.json","REFERENCE","参考文档",701,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Finfrastructure\u002Fterraform\u002Faudit\u002Findex.json",[100,123,144,165,187,203],{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":106,"publishedAt":49},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[107,108,109,110,111,40,47,112,113,114,115,116,117,118,119,120,121,45,122],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":129,"publishedAt":49},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[130,107,131,110,132,133,134,45,44,135,136,137,138,139,40,140,141,38,142,143],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":145,"name":146,"nameZh":6,"description":147,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":148,"categories":149,"keywords":150,"publishedAt":49},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[151,152,153,154,155,156,45,44,157,135,158,159,40,38,160,161,162,163,164,35],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":171,"publishedAt":49},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[108,172,173,174,175,176,177,47,178,45,122,179,180,181,182,183,184,185,186,40],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":188,"name":189,"nameZh":6,"description":190,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":191,"categories":192,"keywords":193,"publishedAt":49},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[194,195,108,196,174,176,197,47,198,178,45,122,135,199,200,201,202,186,40,112],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":204,"name":205,"nameZh":6,"description":206,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":207,"categories":208,"keywords":209,"publishedAt":49},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[210,108,174,211,197,47,212,213,45,122,214,215,216,217,218,219,40,112,220,221],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]