# Trivy IaC Misconfiguration Scanners: Supported Formats and Configuration

> Discover Trivy IaC misconfiguration scanners supporting Terraform, CloudFormation, Kubernetes, Dockerfiles & more. Secure your infrastructure code effectively.

- Repository: [Aqua Security/trivy](https://github.com/aquasecurity/trivy)
- Tags: tutorial
- Published: 2026-03-23

---

**Trivy includes nine built-in IaC misconfiguration scanners covering Terraform, CloudFormation, Kubernetes manifests, Dockerfiles, Helm charts, Azure ARM templates, Ansible playbooks, and both Terraform plan output formats.**

The `aquasecurity/trivy` repository provides a unified misconfiguration detection engine capable of analyzing multiple Infrastructure-as-Code formats through dedicated scanner modules. These implementations reside in `pkg/iac/scanners/` and automatically parse configuration files to execute Rego-based security policies. You control active scanners via the `--misconfig-scanners` CLI flag defined in [`pkg/flag/misconf_flags.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/flag/misconf_flags.go).

## Complete List of IaC Misconfiguration Scanners

Trivy's misconfiguration engine supports nine distinct scanner types, each implemented as a dedicated package under the `pkg/iac/scanners/` directory. The scanners detect insecure patterns using Open Policy Agent (OPA) Rego rules.

### Terraform Scanners

Trivy provides three Terraform-related scanners to cover different stages of the infrastructure lifecycle:

- **Terraform HCL** ([`pkg/iac/scanners/terraform/scanner.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/iac/scanners/terraform/scanner.go)): Parses native Terraform configuration files (`*.tf`) and evaluates them against security policies.

- **Terraform Plan JSON** ([`pkg/iac/scanners/terraformplan/tfjson/scanner.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/iac/scanners/terraformplan/tfjson/scanner.go)): Consumes the JSON output generated by `terraform show -json`, typically saved as [`tfplan.json`](https://github.com/aquasecurity/trivy/blob/main/tfplan.json).

- **Terraform Plan Snapshot** ([`pkg/iac/scanners/terraformplan/snapshot/scanner.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/iac/scanners/terraformplan/snapshot/scanner.go)): Reads native Terraform plan directories (`.tfplan`) directly without requiring JSON conversion.

### Cloud Provider Scanners

- **AWS CloudFormation** ([`pkg/iac/scanners/cloudformation/scanner.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/iac/scanners/cloudformation/scanner.go)): Processes both JSON and YAML stack templates, identifying misconfigurations such as overly permissive IAM policies or unencrypted storage.

- **Azure ARM** ([`pkg/iac/scanners/azure/arm/scanner.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/iac/scanners/azure/arm/scanner.go)): Analyzes Azure Resource Manager JSON templates for security issues specific to Azure resources before deployment.

### Container and Orchestration Scanners

- **Kubernetes** ([`pkg/iac/scanners/kubernetes/scanner.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/iac/scanners/kubernetes/scanner.go)): Handles raw YAML and JSON manifest files, detecting pod security policy violations, excessive RBAC permissions, and missing resource limits.

- **Helm** ([`pkg/iac/scanners/helm/scanner.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/iac/scanners/helm/scanner.go)): Renders Helm templates using the Helm SDK before scanning the resulting Kubernetes manifests, ensuring checks evaluate the final deployed configuration.

- **Dockerfile** ([`pkg/iac/scanners/dockerfile/scanner.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/iac/scanners/dockerfile/scanner.go)): Analyzes Dockerfile instructions for anti-patterns such as running containers as root, using outdated base images, or embedding secrets in image layers.

### Configuration Management Scanners

- **Ansible** ([`pkg/iac/scanners/ansible/scanner.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/iac/scanners/ansible/scanner.go)): Parses YAML playbooks and roles to identify insecure task configurations, such as command injection vulnerabilities or unencrypted sensitive data handling.

## Configuring Scanner Selection

By default, Trivy enables all scanners except raw JSON/YAML detectors when running `trivy config`. The **MisconfScannersFlag** in [`pkg/flag/misconf_flags.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/flag/misconf_flags.go) defines this default set and handles the `--misconfig-scanners` CLI option.

### Using the --misconfig-scanners Flag

Specify exact scanners using comma-separated values:

```bash

# Scan only Terraform and CloudFormation files

trivy config --misconfig-scanners terraform,cloudformation ./infrastructure/

# Scan Kubernetes manifests and Helm charts only

trivy config --misconfig-scanners kubernetes,helm ./deployments/

```

### Available Scanner Identifiers

Use the following identifiers with the `--misconfig-scanners` flag:

- `terraform` (covers HCL files)
- `terraformplan-json` (for `terraform show -json` output)
- `terraformplan-snapshot` (for native `.tfplan` directories)
- `cloudformation`
- `azure-arm`
- `kubernetes`
- `helm`
- `dockerfile`
- `ansible`

### Scanning Terraform Plans in CI/CD

For pipelines generating Terraform plans, target the specific output format:

```bash

# Scan JSON plan output

terraform show -json > plan.json
trivy config --misconfig-scanners terraformplan-json plan.json

# Scan native plan directory

trivy config --misconfig-scanners terraformplan-snapshot ./terraform-plans/

```

## Summary

Trivy's IaC misconfiguration detection encompasses nine specialized scanners:

- **Terraform support** includes HCL parsing (`terraform`), JSON plan analysis (`terraformplan-json`), and native plan snapshot scanning (`terraformplan-snapshot`)
- **Cloud providers** coverage extends to AWS CloudFormation and Azure ARM templates via [`pkg/iac/scanners/cloudformation/scanner.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/iac/scanners/cloudformation/scanner.go) and [`pkg/iac/scanners/azure/arm/scanner.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/iac/scanners/azure/arm/scanner.go)
- **Container security** handles Kubernetes manifests, Helm charts, and Dockerfiles through dedicated scanners under `pkg/iac/scanners/`
- **Configuration management** includes Ansible playbook analysis via [`pkg/iac/scanners/ansible/scanner.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/iac/scanners/ansible/scanner.go)
- All scanners activate via the `--misconfig-scanners` CLI option controlled by `MisconfScannersFlag` in [`pkg/flag/misconf_flags.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/flag/misconf_flags.go)

## Frequently Asked Questions

### How do I scan only Terraform files in a mixed repository?

Use the `--misconfig-scanners` flag with the `terraform` identifier. Execute `trivy config --misconfig-scanners terraform ./` to limit analysis to `*.tf` files while ignoring other configuration formats in the same directory, as implemented in [`pkg/iac/scanners/terraform/scanner.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/iac/scanners/terraform/scanner.go).

### Does Trivy support scanning Terraform plan files?

Yes. Trivy provides two distinct scanners for Terraform plans: `terraformplan-json` for JSON output from `terraform show -json` (implemented in [`pkg/iac/scanners/terraformplan/tfjson/scanner.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/iac/scanners/terraformplan/tfjson/scanner.go)), and `terraformplan-snapshot` for native `.tfplan` directories (implemented in [`pkg/iac/scanners/terraformplan/snapshot/scanner.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/iac/scanners/terraformplan/snapshot/scanner.go)).

### What is the difference between the Kubernetes and Helm scanners?

The **Kubernetes** scanner ([`pkg/iac/scanners/kubernetes/scanner.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/iac/scanners/kubernetes/scanner.go)) processes raw YAML/JSON manifests directly, while the **Helm** scanner ([`pkg/iac/scanners/helm/scanner.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/iac/scanners/helm/scanner.go)) first renders chart templates using the Helm SDK before scanning the resulting manifests. Use the Helm scanner to catch templating-related security issues that only appear in the rendered output.

### Where are the scanner implementations located in the Trivy source code?

Each scanner implementation resides in its own package under `pkg/iac/scanners/`. For example, the CloudFormation scanner is implemented in [`pkg/iac/scanners/cloudformation/scanner.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/iac/scanners/cloudformation/scanner.go), while the Dockerfile scanner lives in [`pkg/iac/scanners/dockerfile/scanner.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/iac/scanners/dockerfile/scanner.go). The CLI flag definitions controlling scanner selection are found in [`pkg/flag/misconf_flags.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/flag/misconf_flags.go).