IaC scanning reads infrastructure definitions and flags risky settings such as containers running as root, unpinned base images or host mounts. It cannot see resources created outside code, changes made after apply, or what software does at runtime. It is a strong early check with a clear boundary.
What it checks
Trivy's documentation says its built in checks detect configuration issues in common IaC files. Examples it gives:
- Dockerfile: a base image with no specific tag such as latest, and a missing non-root user.
- Kubernetes: privilege escalation not disabled, containers not set to run as non-root, hostPath volumes, mounting the Docker socket, and unsafe sysctls.
- Terraform and CloudFormation: supported, with pass or fail results per check.
These are settings, so a reviewer can verify the fix by reading a diff.
What it misses
Unmanaged resources. If someone creates a resource in a console, no file describes it.
Drift. The definition may be fine while the live resource has been edited. That is the job of CSPM.
Values computed at apply time. Variables, modules and data sources can make the final configuration differ from what a static reading sees. Some tools evaluate plans to reduce this gap.
Context. A rule may flag a public bucket meant to host a website. Without knowing intent, the tool cannot tell a mistake from a design.
Software inside the workload. Package vulnerabilities in an image are a container scanning matter.
Getting value from it
- Start with a short rule set that your team agrees makes sense.
- Run on pull requests that change infrastructure files only.
- Allow documented exceptions in code, next to the resource, so reviewers see the reason.
- Treat a new exception as a review item.
- Compare results with CSPM findings now and then to see whether code and reality agree.
Choosing a first rule set
Pick rules for the mistakes that hurt most: public storage, open admin ports, missing encryption, privileged containers and wildcard permissions. Skip stylistic rules until you have a baseline.
Quick check
Will IaC scanning catch a resource someone made by hand?
No. It only reads files. A live account check is needed for that.
Why allow exceptions in code?
A comment or annotation beside the resource records the reason and shows up in review, instead of hiding in a scanner setting.
Sources
Last reviewed: 19 October 2026.
