segrep-iac scanner

Opt-in local IaC misconfiguration scanner for Terraform, Kubernetes, and Dockerfiles

Opt-in local IaC misconfiguration scanner for Segrep that detects security issues in Terraform, Kubernetes manifests, and Dockerfiles — no external binary required.

Why use segrep-iac

Detects 18 categories of IaC misconfigurations across Terraform, Kubernetes, and Dockerfiles.
Runs locally with zero dependencies — no Checkov or Kubescape binary required.
Flags publicly accessible resources, unencrypted storage, privilege escalation risks, and insecure container configurations.
Every finding maps to a CWE reference for compliance tracking.

Scanner behavior

segrep-iac runs as an opt-in scanner.

pnpm segrep scan . --scanners segrep-iac

It walks the scan root and applies rules against IaC files:

*.tf, *.hcl — Terraform files
*.yaml, *.yml — Kubernetes manifests and Docker Compose files
Dockerfile, Dockerfile.* — Dockerfiles

Rules

Terraform

Rule ID	Severity	What it detects
`iac-tf-s3-public-acl`	high	S3 bucket with `acl = "public-read"` or `"public-read-write"`
`iac-tf-s3-no-versioning`	medium	S3 bucket without versioning enabled
`iac-tf-ebs-unencrypted`	high	EBS volume without encryption
`iac-tf-sg-open-cidr`	high	Security group with `0.0.0.0/0` ingress
`iac-tf-rds-public`	critical	RDS instance with `publicly_accessible = true`

Kubernetes

Rule ID	Severity	What it detects
`iac-k8s-privileged`	critical	Container with `privileged: true`
`iac-k8s-allow-privilege-escalation`	high	Container with `allowPrivilegeEscalation: true`
`iac-k8s-run-as-root`	high	Container running as root (`runAsNonRoot: false`)
`iac-k8s-host-network`	high	Pod with `hostNetwork: true`
`iac-k8s-host-pid`	high	Pod with `hostPID: true`
`iac-k8s-host-ipc`	high	Pod with `hostIPC: true`
`iac-k8s-host-port`	medium	Container with `hostPort` set
`iac-k8s-image-latest`	medium	Container image using `:latest` tag
`iac-k8s-writable-root-fs`	medium	Container with `readOnlyRootFilesystem: false`

Dockerfile

Rule ID	Severity	What it detects
`iac-dockerfile-run-as-root`	high	`USER root` or missing `USER` directive
`iac-dockerfile-latest-tag`	medium	`FROM` using `:latest` tag
`iac-dockerfile-add-cop`	low	`ADD` used instead of `COPY`
`iac-dockerfile-curl-pipe-sh`	high	`curl ...
`iac-dockerfile-privileged-port`	medium	Exposing privileged ports (< 1024)

Finding output

Each finding includes:

ruleId — the matched rule (e.g., iac-tf-s3-public-acl)
cweId — CWE reference
line — line number where the issue was found
snippet — the matched line

Example finding:

{
  "id": "segrep-iac:iac-tf-s3-public-acl:main.tf:5",
  "title": "S3 bucket with public ACL",
  "severity": "high",
  "filePath": "main.tf",
  "scanner": "segrep-iac",
  "category": "iac",
  "ruleId": "iac-tf-s3-public-acl",
  "cweId": "CWE-284",
  "line": 5,
  "snippet": "acl = \"public-read\""
}

Policy integration

scanners:
  - segrep-iac

# Allowlist known-good findings by rule ID
allowlist:
  - iac-dockerfile-latest-tag

# Ignore test fixtures
ignore_paths:
  - "fixtures/**"
  - "**/*.test.*"

Examples

IaC only:

docker run --rm -v "$(pwd):/repo:ro" security-scanner:local \
  scan /repo --scanners segrep-iac

Combine with cloud scanning:

docker run --rm -v "$(pwd):/repo:ro" security-scanner:local \
  scan /repo --scanners segrep-iac,segrep-cloud --format json

Fail CI on any high or critical misconfiguration:

docker run --rm -v "$(pwd):/repo:ro" security-scanner:local \
  scan /repo --scanners segrep-iac --fail-on high

Product scan guide
Docker image reference
Add a scanner
segrep-cloud — cloud security scanner
segrep-secrets — native secret detection