Trivy IaC Misconfiguration Scanners: Supported Formats and Configuration

Trivy includes nine built-in IaC misconfiguration scanners covering Terraform, CloudFormation, Kubernetes manifests, Dockerfiles, Helm charts, Azure ARM templates, Ansible playbooks, and both Terraform plan output formats.

The aquasecurity/trivy repository provides a unified misconfiguration detection engine capable of analyzing multiple Infrastructure-as-Code formats through dedicated scanner modules. These implementations reside in pkg/iac/scanners/ and automatically parse configuration files to execute Rego-based security policies. You control active scanners via the --misconfig-scanners CLI flag defined in pkg/flag/misconf_flags.go.

Complete List of IaC Misconfiguration Scanners

Trivy's misconfiguration engine supports nine distinct scanner types, each implemented as a dedicated package under the pkg/iac/scanners/ directory. The scanners detect insecure patterns using Open Policy Agent (OPA) Rego rules.

Terraform Scanners

Trivy provides three Terraform-related scanners to cover different stages of the infrastructure lifecycle:

• Terraform HCL (pkg/iac/scanners/terraform/scanner.go): Parses native Terraform configuration files (*.tf) and evaluates them against security policies.

• Terraform Plan JSON (pkg/iac/scanners/terraformplan/tfjson/scanner.go): Consumes the JSON output generated by terraform show -json, typically saved as tfplan.json.

• Terraform Plan Snapshot (pkg/iac/scanners/terraformplan/snapshot/scanner.go): Reads native Terraform plan directories (.tfplan) directly without requiring JSON conversion.

Cloud Provider Scanners

• AWS CloudFormation (pkg/iac/scanners/cloudformation/scanner.go): Processes both JSON and YAML stack templates, identifying misconfigurations such as overly permissive IAM policies or unencrypted storage.

• Azure ARM (pkg/iac/scanners/azure/arm/scanner.go): Analyzes Azure Resource Manager JSON templates for security issues specific to Azure resources before deployment.

Container and Orchestration Scanners

• Kubernetes (pkg/iac/scanners/kubernetes/scanner.go): Handles raw YAML and JSON manifest files, detecting pod security policy violations, excessive RBAC permissions, and missing resource limits.

• Helm (pkg/iac/scanners/helm/scanner.go): Renders Helm templates using the Helm SDK before scanning the resulting Kubernetes manifests, ensuring checks evaluate the final deployed configuration.

• Dockerfile (pkg/iac/scanners/dockerfile/scanner.go): Analyzes Dockerfile instructions for anti-patterns such as running containers as root, using outdated base images, or embedding secrets in image layers.

Configuration Management Scanners

• Ansible (pkg/iac/scanners/ansible/scanner.go): Parses YAML playbooks and roles to identify insecure task configurations, such as command injection vulnerabilities or unencrypted sensitive data handling.

Configuring Scanner Selection

By default, Trivy enables all scanners except raw JSON/YAML detectors when running trivy config. The MisconfScannersFlag in pkg/flag/misconf_flags.go defines this default set and handles the --misconfig-scanners CLI option.

Using the --misconfig-scanners Flag

Specify exact scanners using comma-separated values:

# Scan only Terraform and CloudFormation files

trivy config --misconfig-scanners terraform,cloudformation ./infrastructure/

# Scan Kubernetes manifests and Helm charts only

trivy config --misconfig-scanners kubernetes,helm ./deployments/

Available Scanner Identifiers

Use the following identifiers with the --misconfig-scanners flag:

• terraform (covers HCL files)
• terraformplan-json (for terraform show -json output)
• terraformplan-snapshot (for native .tfplan directories)
• cloudformation
• azure-arm
• kubernetes
• helm
• dockerfile
• ansible

Scanning Terraform Plans in CI/CD

For pipelines generating Terraform plans, target the specific output format:

# Scan JSON plan output

terraform show -json > plan.json
trivy config --misconfig-scanners terraformplan-json plan.json

# Scan native plan directory

trivy config --misconfig-scanners terraformplan-snapshot ./terraform-plans/

Summary

Trivy's IaC misconfiguration detection encompasses nine specialized scanners:

• Terraform support includes HCL parsing (terraform), JSON plan analysis (terraformplan-json), and native plan snapshot scanning (terraformplan-snapshot)
• Cloud providers coverage extends to AWS CloudFormation and Azure ARM templates via pkg/iac/scanners/cloudformation/scanner.go and pkg/iac/scanners/azure/arm/scanner.go
• Container security handles Kubernetes manifests, Helm charts, and Dockerfiles through dedicated scanners under pkg/iac/scanners/
• Configuration management includes Ansible playbook analysis via pkg/iac/scanners/ansible/scanner.go
• All scanners activate via the --misconfig-scanners CLI option controlled by MisconfScannersFlag in pkg/flag/misconf_flags.go

Frequently Asked Questions

How do I scan only Terraform files in a mixed repository?

Use the --misconfig-scanners flag with the terraform identifier. Execute trivy config --misconfig-scanners terraform ./ to limit analysis to *.tf files while ignoring other configuration formats in the same directory, as implemented in pkg/iac/scanners/terraform/scanner.go.

Does Trivy support scanning Terraform plan files?

Yes. Trivy provides two distinct scanners for Terraform plans: terraformplan-json for JSON output from terraform show -json (implemented in pkg/iac/scanners/terraformplan/tfjson/scanner.go), and terraformplan-snapshot for native .tfplan directories (implemented in pkg/iac/scanners/terraformplan/snapshot/scanner.go).

What is the difference between the Kubernetes and Helm scanners?

The Kubernetes scanner (pkg/iac/scanners/kubernetes/scanner.go) processes raw YAML/JSON manifests directly, while the Helm scanner (pkg/iac/scanners/helm/scanner.go) first renders chart templates using the Helm SDK before scanning the resulting manifests. Use the Helm scanner to catch templating-related security issues that only appear in the rendered output.

Where are the scanner implementations located in the Trivy source code?

Each scanner implementation resides in its own package under pkg/iac/scanners/. For example, the CloudFormation scanner is implemented in pkg/iac/scanners/cloudformation/scanner.go, while the Dockerfile scanner lives in pkg/iac/scanners/dockerfile/scanner.go. The CLI flag definitions controlling scanner selection are found in pkg/flag/misconf_flags.go.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}