<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Infrastructure-as-Code Security — API Reference

## tfsec CLI

```bash
# Basic scan
tfsec .

# JSON output
tfsec . --format json --out results.json

# Minimum severity
tfsec . --minimum-severity HIGH

# Exclude specific checks
tfsec . --exclude aws-s3-enable-versioning

# Scan Terraform plan
terraform plan -out=plan.tfplan
terraform show -json plan.tfplan > plan.json
tfsec --plan plan.json
```

## Checkov CLI

```bash
# Terraform scan
checkov -d . --framework terraform --output json

# CloudFormation scan
checkov -f template.yaml --framework cloudformation

# Kubernetes manifest scan
checkov -d k8s/ --framework kubernetes

# Custom policy directory
checkov -d . --external-checks-dir ./policies

# Specific check
checkov -d . --check CKV_AWS_18,CKV_AWS_19

# Skip checks
checkov -d . --skip-check CKV_AWS_18
```

## KICS CLI

```bash
# Scan all supported types
kics scan -p . -o results/ --report-formats json

# Terraform only
kics scan -p . --type Terraform

# CloudFormation only
kics scan -p . --type CloudFormation

# Exclude queries
kics scan -p . --exclude-queries "ID1,ID2"
```

## Common Check IDs

| Check ID | Description |
|----------|-------------|
| `CKV_AWS_18` | S3 bucket logging enabled |
| `CKV_AWS_19` | S3 bucket encryption enabled |
| `CKV_AWS_23` | Security group has description |
| `CKV_AWS_24` | Security group no 0.0.0.0/0 SSH |
| `CKV_AWS_145` | RDS encryption at rest |
| `CKV_AWS_149` | Secrets Manager secret encrypted |
| `CKV_K8S_1` | Privileged container |
| `CKV_K8S_8` | Liveness probe |
| `CKV_K8S_20` | runAsNonRoot |
| `CKV_K8S_22` | Read-only root filesystem |

## CI/CD Integration

### GitHub Actions

```yaml
- name: tfsec
  uses: aquasecurity/tfsec-action@v1.0.0
  with:
    soft_fail: false

- name: Checkov
  uses: bridgecrewio/checkov-action@master
  with:
    directory: .
    framework: terraform
    soft_fail: false
```

### GitLab CI

```yaml
iac_scan:
  image: bridgecrew/checkov:latest
  script:
    - checkov -d . --output junitxml > checkov.xml
  artifacts:
    reports:
      junit: checkov.xml
```
