KICS
Open source IaC scanner covering more than twenty platforms with thousands of Rego queries.
Technical Architecture & Overview
KICS, Keeping Infrastructure as Code Secure, is a Checkmarx open source scanner for Terraform, Kubernetes, Ansible, CloudFormation, Dockerfiles, and more, shipping thousands of Rego-based queries. It runs as a CLI with SARIF and JSON output, and a GitHub Action integrates it into pipelines. Note that a historical supply chain incident affected the KICS GitHub Action tags, so pin versions carefully.
Targeted Technical Use Cases
Broad IaC scanning across mixed template stacks in CI pipelines.
Evaluation & Trade-offs
Core Strengths
- +Widest platform coverage among open source IaC scanners.
- +Custom Rego queries for organization-specific policy.
- +Straightforward CI integration.
Trade-Offs & Limitations
- -Query quality varies by platform.
- -GitHub Action distribution had a past tampering incident; verify versions.
Defensive Security Application
Catching insecure infrastructure configurations before they deploy.
Frequently Asked Questions
What is KICS?→
KICS, Keeping Infrastructure as Code Secure, is a Checkmarx open source scanner for Terraform, Kubernetes, Ansible, CloudFormation, Dockerfiles, and more, shipping thousands of Rego-based queries. It runs as a CLI with SARIF and JSON output, and a GitHub Action integrates it into pipelines. Note that a historical supply chain incident affected the KICS GitHub Action tags, so pin versions carefully.
What is KICS used for?→
Broad IaC scanning across mixed template stacks in CI pipelines.
What are the strengths of KICS?→
- +Widest platform coverage among open source IaC scanners.
- +Custom Rego queries for organization-specific policy.
- +Straightforward CI integration.
What are the limitations of KICS?→
- +Query quality varies by platform.
- +GitHub Action distribution had a past tampering incident; verify versions.
How is KICS used defensively?→
Catching insecure infrastructure configurations before they deploy.