/scan-iac

description: Scan Infrastructure as Code for compliance violations

Scan IaC

Scans Infrastructure as Code (Terraform, CloudFormation, Kubernetes) for compliance violations and provides automated remediation suggestions.

Usage

/grc-engineer:scan-iac <directory> <frameworks> [options]

Arguments

• `$1` - Directory to scan (e.g., `./terraform`, `./k8s`)
• `$2` - Comma-separated frameworks (e.g., `SOC2,PCI-DSS,NIST`)
• `$3` - Output format (optional): `detailed`, `summary`, `json`, `sarif` (default: `detailed`)
• `$4` - Options (optional): `--fix`, `--severity=high`, `--exclude=test/`

Supported IaC Formats

• **Terraform** (`.tf` files)
• **CloudFormation** (`.yaml`, `.json` templates)
• **Kubernetes** (`.yaml` manifests)
• **Azure ARM** (`.json` templates)
• **Pulumi** (`.yaml` stack files)

Examples

# Scan Terraform directory for multiple frameworks
/grc-engineer:scan-iac ./terraform SOC2,PCI-DSS,NIST detailed

# Quick summary scan
/grc-engineer:scan-iac ./infrastructure ISO,GDPR summary

# Scan with auto-fix
/grc-engineer:scan-iac ./terraform PCI-DSS detailed --fix

# High severity issues only
/grc-engineer:scan-iac ./k8s SOC2,NIST summary --severity=high

# Export SARIF for CI/CD integration
/grc-engineer:scan-iac ./terraform SOC2,PCI-DSS sarif

Output Format

Detailed Mode

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
IAC COMPLIANCE SCAN RESULTS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Scan Target: ./terraform
Frameworks: SOC2, PCI-DSS, NIST 800-53
Files Scanned: 23 (15 .tf, 5 .yaml, 3 .json)
Scan Duration: 4.2s

SUMMARY:
  ✓ Satisfied: 42 controls (73%)
  ✗ Violations: 8 controls (14%)
  ⚠ Partial: 7 controls (12%)
  ℹ Recommendations: 12

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
VIOLATIONS (8)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

🔴 HIGH SEVERITY (3)

[1] Encryption at Rest - Missing S3 Bucket Encryption
    Frameworks: SOC2 CC6.7, PCI-DSS 3.4, NIST SC-28
    File: terraform/s3_buckets.tf:12
    Resource: aws_s3_bucket.data

    Issue:
    S3 bucket does not have server-side encryption enabled.
    This violates encryption at rest requirements for all
    three frameworks.

    Current Configuration:
    ```hcl
    resource "aws_s3_bucket" "data" {
      bucket = "customer-data-bucket"

      # Missing encryption configuration
    }

✓ Remediation: Add server-side encryption configuration:

    resource "aws_s3_bucket" "data" {
      bucket = "customer-data-bucket"

      # Required for SOC2 CC6.7, PCI 3.4, NIST SC-28
      server_side_encryption_configuration {
        rule {
          apply_server_side_encryption_by_default {
            sse_algorithm = "AES256"  # or "aws:kms" for PCI
          }
        }
      }
    }

Auto-fix available: Run with --fix flag

[2] Audit Logging - CloudTrail Retention Too Short Frameworks: SOC2 CC7.3, PCI-DSS 10.7, NIST AU-11 File: terraform/cloudtrail.tf:8 Resource: aws_cloudtrail.audit

Issue: CloudTrail log retention is set to 90 days, but PCI-DSS requires 1 year minimum (365 days).

Current Configuration:

    resource "aws_cloudtrail" "audit" {
      name           = "audit-trail"
      s3_bucket_name = aws_s3_bucket.logs.id

      # Retention too short
      event_selector {
        ...
      }
    }

    resource "aws_s3_bucket_lifecycle_configuration" "logs" {
      rule {
        expiration {
          days = 90  # ✗ TOO SHORT
        }
      }
    }

✓ Remediation: Update lifecycle rule to 365 days:

    resource "aws_s3_bucket_lifecycle_configuration" "logs" {
      bucket = aws_s3_bucket.logs.id

      rule {
        id     = "retention"
        status = "Enabled"

        # Keep online for 6 months
        transition {
          days          = 180
          storage_class = "GLACIER"
        }

        # Total retention: 1 year (PCI/SOC2 requirement)
        expiration {
          days = 365  # ✓ COMPLIANT
        }
      }
    }

[3] Network Security - Security Group Too Permissive Frameworks: PCI-DSS 1.2, NIST SC-7, SOC2 CC6.6 File: terraform/security_groups.tf:24 Resource: aws_security_group.web

Issue: Security group allows unrestricted SSH access (0.0.0.0/0:22). Violates least privilege and network segmentation requirements.

Current Configuration:

    resource "aws_security_group" "web" {
      ingress {
        from_port   = 22
        to_port     = 22
        protocol    = "tcp"
        cidr_blocks = ["0.0.0.0/0"]  # ✗ TOO PERMISSIVE
      }
    }

✓ Remediation: Restrict SSH to specific IP ranges:

    resource "aws_security_group" "web" {
      ingress {
        description = "SSH from corporate VPN only"
        from_port   = 22
        to_port     = 22
        protocol    = "tcp"
        cidr_blocks = ["10.0.0.0/8"]  # ✓ RESTRICTED
      }
    }

Or remove SSH entirely and use AWS Systems Manager Session Manager.

🟡 MEDIUM SEVERITY (5)

[4] Vulnerability Management - Missing Patch Management Frameworks: NIST SI-2, PCI-DSS 6.2 File: terraform/ec2_instances.tf:45

Issue: No AWS Systems Manager Patch Manager configuration detected.

✓ Remediation: Add patch baseline and maintenance window:

    resource "aws_ssm_patch_baseline" "compliance" {
      name             = "compliance-baseline"
      operating_system = "AMAZON_LINUX_2"

      approval_rule {
        approve_after_days = 7
        compliance_level   = "CRITICAL"
        patch_filter {
          key    = "CLASSIFICATION"
          values = ["Security"]
        }
      }
    }

    resource "aws_ssm_maintenance_window" "patching" {
      name     = "critical-patching"
      schedule = "cron(0 2 ? * SUN *)"  # Weekly
      duration = 3
      cutoff   = 1
    }

[5] Access Control - Missing MFA for Root Account Frameworks: NIST IA-2(1), PC