KICS

kics scan -p <path>

Scan infrastructure as code with KICS (from Checkmarx), detecting misconfigurations, vulnerabilities, and secrets in multiple formats.

Run it in the IaC pipeline when you want multi-format analysis with KICS: KICS analyzes files (Terraform, CloudFormation, Kubernetes, Dockerfile, Ansible, Helm) and reports findings — misconfigurations, vulnerabilities, secrets — with the query (rule) and severity. It's Checkmarx's IaC scanner: broad format coverage. In DevSecOps, KICS is the IaC pipeline gate: high-severity findings block before apply.

Don't use it as a complete analysis: KICS covers IaC — application code is SAST and dependencies are SCA. Generic queries generate false positives: they are triaged (query exclusion). And watch out: KICS performance on large repos is heavy (format analysis) — run it in the pipeline (not on every local push). Combining with specific scanners (tfsec for Terraform, 045) covers the spectrum.