A misconfiguration in a pull request is cheap to fix. The same one in production is a ticket and a meeting. Safeguard's IaC product aims at the first case.
What it is
The page says it catches misconfigurations in Terraform, CloudFormation, Pulumi, Helm and Kubernetes manifests before they ship. Supported inputs include Terraform HCL, modules, providers and state, CloudFormation YAML and JSON with change sets, Pulumi programs in TypeScript, Python, Go and .NET, and Kubernetes manifests, charts and kustomize. Clouds named are AWS, Azure and GCP.
Features listed:
- PR time scanning with inline review comments.
- Prioritization by whether a resource is exposed in the resource graph.
- Plan and apply time gating: blocking checks fail the pipeline, advisory checks comment and allow an exception.
- Drift detection against the live cloud account, with a reconcile path.
- A policy library mapped to CIS Benchmarks, PCI DSS, HIPAA and SOC 2, plus custom Rego or Cue policies.
- Signed SBOMs for published modules and charts.
How to use it
- Start with advisory checks on one repository.
- Read a week of comments and fix the rules that are wrong.
- Promote the checks you trust to blocking.
- Schedule a drift check and look at what the live account has that the code does not.
What to verify
The page claims noise reduction without precision figures. Measure it on a repository you know.
Quick check
What is the difference between blocking and advisory checks?
Blocking checks fail the pipeline. Advisory checks comment and allow an exception.
