soldevelo/infrascan repository overview

⁠SolDevelo InfraScan

Open Source IaC Cost & Security Scanner

InfraScan is an advanced auditing tool that analyzes Infrastructure as Code (e.g., Terraform, CloudFormation) and container configurations to identify cost antipatterns and security vulnerabilities before you deploy.

⁠🚀 Quick Start

The easiest way to scan your project:

docker run --rm -v $(pwd):/scan soldevelo/infrascan:latest

This command scans the current directory and displays a comprehensive report (Cost + Security + Containers) directly in your terminal.

⁠✨ Key Features

• 💰 Cost Optimization: Detects old generation instances, oversized resources, missing S3 lifecycle rules, or absent AWS budgets.
• 🛡️ IaC Security: Built-in Checkov engine scans 1000+ security rules for Terraform, CloudFormation, Kubernetes, and more.
• 🐳 Advanced Container Analysis:
  • Scans Docker images for vulnerabilities (CVEs) using Docker Scout and Grype.
  • Zero-Config Scans — Automatic fallback to Grype if Docker Scout credentials are missing.
  • Dynamic Images — Full support for environment variables in docker-compose.yml (e.g., ${TAG:-latest}).
  • Cloud Native — Automatic Amazon ECR authentication via AWS CLI.
• 📊 Pipeline Visibility (New in v1.0.4): Beautiful, colored findings summary is printed directly to your CI/CD logs even when generating HTML/JSON reports — no more downloading artifacts just to see what failed!
• 🏗️ CI/CD Ready: Seamlessly integrates with GitHub Actions, GitLab CI, and Bitbucket Pipelines.
• 🔧 CLI Helper: Includes infrascan binary in PATH for direct use in pipeline containers.

⁠🛠️ Usage & Arguments

docker run --rm -v $(pwd):/scan soldevelo/infrascan [options]

⁠Available Options

• --scanner: comprehensive (default), regex, checkov, containers. You can combine them: --scanner regex,containers.
• --format: text, json, html.
• --out: Output file path (e.g., /scan/report.html).
• --fail-on: Exit with code 1 if findings match criteria:
  • Keywords: any, high_critical.
  • Grades: grade_a through grade_f (fails if grade is lower than specified).
  • Priorities: priority_critical through priority_info.

⁠🤖 GitHub Actions Integration

steps:
  - uses: actions/checkout@v4
  - name: Run InfraScan Audit
    run: |
      docker run --rm \
        -v ${{ github.workspace }}:/scan \
        -e MY_TAG=${{ github.sha }} \
        soldevelo/infrascan:latest \
        --format html --out /scan/report.html \
        --fail-on high_critical

  - name: Upload Report
    uses: actions/upload-artifact@v4
    if: always()
    with:
      name: infrascan-report
      path: report.html

⁠🏷️ Image Tags

• latest: Always the latest stable release.
• v1.0.8: Latest release with enhanced terminal reporting.

⁠🤝 Support & Community

• GitHub: https://github.com/SolDevelo/InfraScan⁠
• Slack: Join our community⁠
• Contact: https://soldevelo.com/contact⁠