Terrascan

How it works

Terrascan is a Go CLI. On first run (or with terrascan init) it clones its policies from the master branch of github.com/tenable/terrascan into ~/.terrascan, under pkg/policies/opa/rego.

IaC providers parse Terraform HCL2, CloudFormation, ARM, Kubernetes YAML or JSON, Helm v3, Kustomize and Dockerfiles into a normalized JSON config per resource type, which you can print with --config-only. Policies are Rego files paired with a JSON rule file (name, severity, category, reference_id) and run in an embedded OPA engine against that config.

Results go out through human, JSON, YAML, XML, JUnit XML and SARIF writers. --find-vuln looks up images referenced in the IaC in the registry's own vulnerability scanning (AWS, Azure, GCP, Harbor), --webhook-url posts results to a URL, and terrascan server runs the same scanner as an HTTP API.

What it catches

• Public storage, open security groups and missing encryption in Terraform, CloudFormation and ARM
• Privileged pods and missing security contexts in Kubernetes, Helm and Kustomize
• Dockerfile misconfigurations
• GitHub repository and webhook resources defined with the Terraform GitHub provider
• Known CVEs in referenced images, through the registry's scanner

Run it

brew install terrascan
terrascan scan -i terraform -d .

What leaves your machine

terrascan init clones the policy repository from GitHub. --find-vuln calls the registry provider's API, --webhook-url posts results, and -r git/s3/gcs/http downloads the remote IaC.

Limits

• Archived on 20 November 2025. No new policies, parser fixes or dependency updates, and Homebrew has marked its formula deprecated.
• Policies are pulled at run time from the archived repository's master branch, so the rule set is frozen.
• Migrate to Checkov, KICS or trivy config.

Links

• Repository: tenable/terrascan ↗
• Policy format ↗
• terrascan-action ↗

Related tools