IaC and container config Workflow analysisOpen source

KICS

Runs Rego queries against Terraform, CloudFormation, Kubernetes, Dockerfiles, Ansible, GitHub workflows and other IaC to find misconfigurations.

github.com/Checkmarx/kics ↗

Stars: ★ 2,716
License: Apache-2.0
Language: Open Policy Agent
Latest release: v2.2.0 · 17 Sept 2026
Last push: 8 Oct 2026
OpenSSF Scorecard: Not in the weekly scan

ghtier rating3/5 · Situational

A broad, fully open Rego query set, but its own action and Docker images were hijacked twice in 2026 and new versions now ship as source only.

How it works

KICS (Keeping Infrastructure as Code Secure) is a Go binary from Checkmarx. It walks local paths and archives, or copies git, S3 and GCS sources to a temp folder first, works out the platform of each file (Terraform, CloudFormation, Kubernetes, Helm, Dockerfile, Docker Compose, Ansible, OpenAPI, Pulumi, Crossplane, Bicep, GitHub workflows and more) and parses it into normalized JSON.

Queries are written in Rego and run by an embedded Open Policy Agent engine against that JSON, with each platform's queries running concurrently. Every query is a folder with query.rego, metadata.json (id, severity, category, description) and test fixtures, so writing your own means adding a folder and pointing --queries-path at it. The GitHub workflow queries flag untrusted event fields in run: and github-script blocks per trigger, unsecured commands, and uses: refs that are not a 40-character SHA (anything under actions/ is exempt).

Secret detection is the one query written in Go. It applies regex rules from regex_rules.json, with Shannon entropy bounds on capture groups and allow rules to drop false positives, and you can swap in your own rules with --secrets-regexes-path.

Results are written as JSON by default, or SARIF, HTML, PDF, JUnit, SonarQube, GitLab SAST, CycloneDX, ASFF, CSV and Code Climate. The exit code encodes the highest severity found (60 critical down to 20 info), adjustable with --fail-on and --ignore-on-exit. Inline # kics-scan ignore, ignore-line, ignore-block and disable=<query id> comments suppress findings, and kics remediate applies automatic fixes for some queries from a results file.

What it catches

Public storage, open security groups and missing encryption in Terraform, CloudFormation, ARM, Bicep and Pulumi
Privileged containers and host namespace use in Kubernetes, Helm, Knative and Crossplane
Dockerfile and Docker Compose misconfigurations
Untrusted event fields in workflow run: and github-script blocks
Third-party actions not pinned to a full commit SHA
ACTIONS_ALLOW_UNSECURE_COMMANDS in workflows
Hardcoded passwords and keys in scanned IaC files

Run it

brew install kics
export KICS_QUERIES_PATH="$(brew --prefix kics)/share/kics/assets/queries"
kics scan -p . -o kics-results --report-formats json,sarif

In GitHub Actions

kics:
  runs-on: ubuntu-latest
  permissions:
    contents: read
    security-events: write
  steps:
    - uses: actions/checkout@<sha> # v7.0.1
      with:
        persist-credentials: false
    - run: mkdir -p kics-results
    - uses: Checkmarx/kics-github-action@<sha> # v2.1.20
      with:
        path: .
        output_path: kics-results
        output_formats: json,sarif
        ignore_on_exit: results
    - uses: github/codeql-action/upload-sarif@<sha> # v4.38.3
      with:
        sarif_file: kics-results/results.sarif

What leaves your machine

A local scan sends nothing except crash reports to sentry.io, which you turn off by setting DISABLE_CRASH_REPORT to 0 or false. Git, S3 and GCS paths are downloaded before scanning.

Limits

On 23 March 2026 (TeamPCP) attackers used stolen credentials to repoint all 35 tags of Checkmarx/kics-github-action to a credential stealer. On 22 April 2026 the checkmarx/kics Docker Hub tags (latest, alpine, debian, v2.1.20) were overwritten with a build that sent scan results to an attacker domain. Pin the action by SHA, pin images by digest, and rotate secrets if you ran it in either window.
The action's Dockerfile builds FROM checkmarx/kics:v2.1.20 by tag and on wolfi-base:latest, so pinning the action SHA does not pin the scanner image.
Since the April incident v2.1.21 and v2.2.0 shipped as source code only. Docker Hub and the prebuilt binaries stop at v2.1.20, so a current version means Homebrew or building from source.
Only four GitHub workflow queries, all regex over the YAML with no dataflow through env: or step outputs. Use zizmor for workflow analysis.

Related incidents

OrganizationMarch – April 2026

TeamPCP tag force-overwrite campaign

The most complete demonstration of tag-write as a permission tier. On 19 March 2026 (CVE-2026-33634), continuing an attack that began in late February, the actors used credentials with tag-write privileges to publish Trivy v0.69.4 and force-overwrite 76 of 77 tags in aquasecurity/trivy-action and all seven in aquasecurity/setup-trivy, redirecting trusted versions to malicious commits with no visible change in release metadata. Checkmarx's KICS GitHub Action followed on 23 March, when all 35 of its tags were moved through a compromised service account, and on 24 March LiteLLM versions 1.82.7 and 1.82.8 were uploaded straight to PyPI with credentials taken from LiteLLM's own CI, where Trivy ran. Researchers traced at least seven waves through to @bitwarden/cli hijacked with stolen KICS npm tokens, and elementary-data via Actions script injection. Each compromised environment yielded the credentials for the next.

Click to open →

GitHub stats as of 10 Oct 2026. How ratings work.