<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# IaC Scanning — API Reference

## Checkov CLI

```bash
# Scan Terraform directory
checkov -d ./terraform/ --framework terraform --output json

# Scan Kubernetes manifests
checkov -d ./k8s/ --framework kubernetes --output json --compact

# Run specific checks
checkov -d . --check CKV_AWS_18,CKV_AWS_21,CKV_AWS_145

# Skip checks
checkov -d . --skip-check CKV_AWS_41,CKV2_AWS_6

# Custom policy directory
checkov -d . --external-checks-dir ./custom_checks/

# Soft fail (exit 0 even with findings)
checkov -d . --soft-fail

# SARIF output
checkov -d . --output sarif --output-file results.sarif
```

## tfsec CLI

```bash
# Basic scan
tfsec ./terraform/

# Minimum severity
tfsec ./terraform/ --minimum-severity HIGH

# JSON output
tfsec ./terraform/ --format json --out results.json

# Exclude specific checks
tfsec ./terraform/ --exclude aws-s3-enable-bucket-logging

# Custom checks directory
tfsec ./terraform/ --custom-check-dir ./custom_checks/

# SARIF output
tfsec ./terraform/ --format sarif --out results.sarif
```

## KICS CLI

```bash
# Scan directory
kics scan -p ./k8s/ -o ./results/

# Specific platforms
kics scan -p . --type Terraform,Kubernetes

# Fail on severity
kics scan -p . --fail-on high,medium

# Exclude queries
kics scan -p . --exclude-queries "id1,id2"

# Custom queries
kics scan -p . --queries-path ./custom_queries/
```

## OPA / Conftest

```bash
# Test with conftest
conftest test ./terraform/ --policy ./policy/

# OPA eval
opa eval --data policy/ --input plan.json "data.terraform.deny"

# Pull policies from registry
conftest pull oci://registry.example.com/policies/terraform
```

## Key Checkov Check IDs

| Check ID | Description |
|----------|-------------|
| `CKV_AWS_18` | S3 access logging enabled |
| `CKV_AWS_19` | S3 server-side encryption |
| `CKV_AWS_21` | S3 versioning enabled |
| `CKV_AWS_145` | S3 KMS encryption |
| `CKV_AWS_23` | Security group restricted ingress |
| `CKV_AWS_24` | No unrestricted SSH (port 22) |
| `CKV_AWS_25` | No unrestricted RDP (port 3389) |
| `CKV_AWS_79` | IMDSv2 required for EC2 |
| `CKV_K8S_1` | No privileged containers |
| `CKV_K8S_6` | No root containers |

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | All checks passed |
| 1 | Failed checks found |
| 2 | Error in execution |
