GitLab infrastructure as code scanning checks definition files such as Terraform, Kubernetes manifests, CloudFormation and Dockerfiles for misconfigurations before they reach the default branch. It uses the KICS analyzer and runs as a CI job on every pipeline, so a missed file type is the main risk.
What it covers
The GitLab documentation lists these formats: Ansible, AWS CloudFormation, Dockerfile, Google Deployment Manager, Kubernetes and OpenAPI. Azure Resource Manager is supported for JSON only, and Bicep files must be converted with the Bicep CLI first.
Terraform has a nuance. KICS has resource queries for Alibaba Cloud, AWS, Azure, Databricks, GitHub, Google Cloud, Kubernetes, NIFCLOUD and Tencent Cloud. For other providers you get provider independent checks only.
Tier differences
Scanning itself is listed on Free, Premium and Ultimate. Merge request visibility, approval workflows, vulnerability report integration, result downloads and rule optimization need Ultimate. Offline configuration needs Premium or Ultimate on Self-Managed.
How to enable it
- Confirm you have the Maintainer or Owner role, a Linux runner with the Docker or Kubernetes executor, and at least 4 GB of RAM.
- Add the
Jobs/SAST-IaC.gitlab-ci.ymltemplate, or theiac-sastcomponent, to your CI file. - Validate the pipeline, commit and merge.
- Open the pipeline Security tab to see location, severity, scanner and identifiers.
If no supported files exist, the job completes with no findings. That is normal, but it means a green job is not proof that your Terraform was checked.
Limits to plan for
| Limit | Consequence |
|---|---|
| Rules can be disabled or overridden, not added or replaced | Custom checks need another tool |
| Terraform modules from custom registries are not scanned | Module internals may be unchecked |
| AMD64 only, no Windows runners | Runner choice is constrained |
| Findings can become "No longer detected" after rule updates | Trend charts need care |
| Exclusions use KICS comments, for some file types | Suppression is file specific |
What IaC scanning cannot tell you
It reads files. It does not see what is actually deployed, so drift between code and the live cloud account is invisible to it. A scan of the repo and a check of the running environment answer different questions, and an audit may ask for both.
A simple review habit
Run the job on a branch that adds one deliberately weak setting, such as a storage bucket open to the public. Confirm the scanner flags it and the finding shows in the merge request. That one test tells you whether your pipeline wiring works.
Where a dedicated scanner fits
If you want IaC findings in the same queue as code and dependency issues, or want one policy to apply across hosts, a separate scanner can help. Safeguard offers policies, gates and guardrails plus a free scan at gold.safeguard.sh/scan.
Quick check
Does a passing IaC job mean my Terraform is safe?
No. It means the scanner found nothing in the files and rules it supports. Custom registry modules, unsupported providers and runtime drift are outside that check.
Can I add my own rules to GitLab IaC scanning?
The documentation says rules can be disabled or have attributes overridden, but cannot be added or replaced.
Sources
Last reviewed: 19 October 2026.
