- 01IaC scanners (Checkov, KICS, tfsec, Terrascan) produce thousands of findings on a typical Terraform repo. Most are noise. Pipeline configuration determines whether the tool gets respected or ignored.
- 02Tiering: Critical (block — public buckets, internet-open SGs, hardcoded secrets), High (block in main, warn in PR — over-privileged IAM, missing encryption-at-rest), Medium (warn — missing tags, weak logging), Low (off by default — style, optional).
- 03Allow suppression at the rule level only via a policy file in the repo with security-team approval. Never suppress in the tool UI — the change is invisible. Document rationale; require 90-day re-review.
- 04Biggest leverage is shipping a curated set of internal Terraform modules secure by construction — pre-encrypted buckets, allowlist-only SGs, IAM roles with built-in boundary policies. Engineers consume modules, security guarantees come along.
IaC security scanners — Checkov, KICS, tfsec, Terrascan, vendor equivalents — produce thousands of findings on a typical Terraform repo. Most of those findings are noise. The pipeline configuration determines whether the tool gets respected or ignored.
Tiering findings
- 01Critical (block) — public S3 buckets, open security groups to internet, hardcoded secrets
- 02High (block in main, warn in PR) — over-privileged IAM, missing encryption-at-rest
- 03Medium (warn) — missing tags, weak logging configuration
- 04Low (off by default) — style, optional best practice
Suppression discipline
Allow suppression at the rule level only via a policy file in the repo, requiring a security-team approval. Never suppress in the tool's UI — the change is invisible. Document the rationale; require a 90-day re-review.
Module-level controls
The biggest leverage is shipping a curated set of internal Terraform modules that are secure by construction. Buckets that come pre-encrypted, security groups that take an explicit allowlist, IAM roles with built-in boundary policies. Engineers consume the modules; the security guarantees come along.