IaC Scanner
Paste Terraform, Kubernetes YAML, or a Dockerfile to catch misconfigurations — public S3 buckets, open security groups, privileged containers — before they reach production.
What This Scans For
Pattern-based detection — a fast first pass, not a full policy-as-code engine like Checkov or tfsec.
Frequently Asked Questions
What does this scan for?
Terraform: public S3 ACLs, disabled S3 public-access blocks, security groups open to 0.0.0.0/0 (flagged critical on sensitive ports like SSH/RDP/databases), publicly accessible or unencrypted RDS instances, wildcard IAM policies, unencrypted EBS volumes, and disabled CloudTrail logging. Kubernetes YAML: privileged containers, host networking/PID sharing, hostPath mounts, containers running as root, missing resource limits, and privilege escalation. Dockerfiles: unpinned :latest base images, running as root, ADD-from-URL, and credentials baked in via ENV.
How is the file type detected?
Automatically, from the content you paste — a Dockerfile is recognized by its instruction keywords (FROM, RUN, COPY…), Kubernetes YAML by top-level apiVersion/kind fields, and Terraform by resource "type" "name" { } blocks. No need to tell it which one you're pasting.
Is this a replacement for Checkov, tfsec, or Trivy?
No. Those are full policy-as-code engines with hundreds of rules and real HCL/YAML parsers. This checks the highest-signal, most common misconfigurations in the same categories using pattern matching — a fast first pass on a single file, not a replacement for running a real scanner in CI against your whole repo.
Is my pasted content stored anywhere?
No. Content is scanned in memory for this one request only and never logged or written to a database.
Why does it say the file type could not be detected?
It only recognizes Terraform, Kubernetes YAML, and Dockerfiles by their structural markers. If you pasted a different IaC format (CloudFormation, Pulumi, Ansible) or an incomplete snippet missing the recognizable top-level syntax, detection will fail — paste the full file.
Catch Misconfigurations Continuously
A paste is a spot check on one file. CertNotify's continuous monitoring is built for catching what changes across your whole stack over time.