Scan the infrastructure definition before it's ever provisioned.

IaC scanning applies SAST's idea to Terraform and Kubernetes manifests — and every arrow in the full supply chain is its own potential attack point.

checkov finding

CKV_AWS_20: S3 bucket allows public READ access
  FAILED: aws_s3_bucket.data
  13 |   bucket = "my-app-data"
  14 |   acl    = "public-read"

# the fix — block public access explicitly
resource "aws_s3_bucket_public_access_block" "data" {
  block_public_acls = true
}

Every arrow is a potential attack point

Dev code

→

Deps

→

Build

→

Artifact

→

Registry

→

Deploy

→

Prod

Misconfigured infrastructure is one of the most common real breach causes — IaC scanning catches it before the resource ever exists, not after a cloud posture scan finds it live.