KICS

KICS performs static analysis of infrastructure as code to find security vulnerabilities, compliance issues, and misconfigurations early in development, before they reach deployment. It scans Terraform, Kubernetes, Dockerfiles, Docker Compose, CloudFormation, Ansible, Helm, OpenAPI, and more.

Scanning is driven by customizable queries and adjustable heuristics rules, so teams can edit, extend, and add their own checks. Detected issues are presented in a results format built for quick review and fixing, and KICS plugs into CI/CD pipelines.

Its architecture is designed to make adding support for new infrastructure as code platforms straightforward. KICS runs locally in development and CI environments rather than as a hosted service, and it is open source under the Apache 2.0 license.