KICS

KICS, short for Keeping Infrastructure as Code Secure, is an open-source solution for static code analysis of Infrastructure as Code. Powered by Checkmarx, the project helps development and security teams identify security vulnerabilities, compliance issues, and infrastructure misconfigurations before deployment. It supports a broad range of technologies, including Terraform, Kubernetes, Docker, AWS CloudFormation, Ansible, Helm, Google Deployment Manager, AWS SAM, Microsoft ARM, Azure Blueprints, OpenAPI, Pulumi, Crossplane, Knative, and Serverless Framework.

KICS provides more than 2,000 customizable security queries, allowing users to adapt existing checks or add new ones. Its architecture is designed to make support for additional IaC solutions easier to introduce. The tool is presented as straightforward to install and run, with readable results and integration capabilities for continuous integration workflows. KICS also offers an auto-scanning Visual Studio Code plugin for scanning IaC while editing. Documentation, GitHub resources, and community contribution channels help users get started, integrate the solution, and participate in ongoing development. The project’s scanning engine and security queries are openly available.