Terrascan

Terrascan is an open-source security scanner designed to detect compliance and security violations in Infrastructure as Code (IaC) configurations. It helps organizations ensure that security best practices and compliance requirements are observed before provisioning cloud-native infrastructure, supporting popular IaC tools like Terraform, Kubernetes, Argo CD, Atlantis, and AWS CloudFormation. The tool comes with over 500 out-of-the-box policies, allowing users to scan their IaC against common policy standards such as the CIS Benchmark. For advanced users, Terrascan leverages the Open Policy Agent (OPA) engine, enabling the creation of custom policies using the Rego query language. This flexibility makes it suitable for developers, DevOps engineers, and security teams looking to integrate security early into their development lifecycle and maintain secure cloud infrastructure.