qa-iac
Infrastructure-as-code testing + security policy: 4 skills (helm-chart-tester, policy-as-code-runner, checkov-policy, trivy-config - the tfsec successor, with the legacy tfsec workflow in its references) and 1 agent (terraform-plan-reviewer). Cross-scanner IaC finding triage is handled by security-finding-triager in the qa-security-scanning plugin.
Install this plugin
/plugin install qa-iac@testland-qaPart of role bundle: qa-role-security
qa-iac
Infrastructure-as-code testing + security policy. Terraform plan review, Helm chart unit testing, OPA / Conftest / Cedar policy testing, plus two differentiated security scanners (Checkov, Trivy - the tfsec successor, legacy tfsec workflow in its references). Cross-scanner IaC finding triage (unified verdict across Checkov / tfsec / KICS output) is handled by security-finding-triager in the qa-security-scanning plugin.
Components
| Type | Name | Description |
|---|---|---|
| Agent | terraform-plan-reviewer | Read-only adversarial reviewer that analyzes a terraform plan output (JSON form via terraform show -json) for high-blast-radius changes - flags resource destruction (deletes), security degradation (broader IAM, public exposure, encryption disabled), drift (manually-changed resources), and risky combinations (DB destroy + new DB without import). Per-flag severity + remediation. Use as a PR-time gate against unintentional infrastructure damage. |
| Skill | helm-chart-tester | Configures helm-unittest for Helm chart unit testing - installs helm-unittest plugin, authors tests/*.yaml per template, asserts on rendered manifests (isKind, isAPIVersion, equal, matchRegex), runs via helm unittest. Plus chart linting (helm lint) and render testing (helm template). Use when the team ships Helm charts and needs unit-level verification of the templates. |
| Skill | policy-as-code-runner | Configures policy-as-code testing using OPA / Conftest / Cedar - authors policies in Rego (OPA's language), runs Conftest against Kubernetes manifests / Terraform plans / Dockerfiles / arbitrary structured data, integrates with CI for PR-time policy gates. Per OPA's docs: "an open source, general-purpose policy engine that unifies policy enforcement across the stack." Use to express + enforce custom policies (cost limits, tagging requirements, security baselines) that Checkov / tfsec / KICS don't cover. |
| Skill | checkov-policy | Configures Checkov for IaC security scanning across Terraform, CloudFormation, Kubernetes, Helm, ARM, Serverless, AWS CDK - installs pip install checkov, runs against per-framework directories, customizes rules via skip / override / custom Python checks, integrates SARIF / JUnit output for CI dashboards. Per Checkov: "scans cloud infrastructure configurations to find misconfigurations before they're deployed." Use as the broad-coverage IaC security scanner. |
| Skill | trivy-config | Trivy IaC/config scanning (tfsec successor): misconfig policies, custom Rego, SARIF, CI gate; legacy tfsec workflow + custom YAML rules in references/tfsec-legacy.md. |
Install
/plugin marketplace add testland/qa
/plugin install qa-iac@testland-qaSkills
checkov-policy
Configures Checkov for IaC security scanning across Terraform, CloudFormation, Kubernetes, Helm, ARM, Serverless, AWS CDK - `pip install checkov`, custom Python checks, SARIF / JUnit output, and `--baseline` gating so CI fails only on new findings in legacy code. Use for the broadest built-in rule set with Python custom checks; for a consolidated new-project scanner (and the tfsec successor) use trivy-config.
helm-chart-tester
Configures helm-unittest for Helm chart unit testing - installs the `helm-unittest` plugin, authors `tests/*.yaml` per template, asserts on rendered manifests (`isKind`, `equal`, `matchRegex`, snapshots), plus `helm lint` and `helm template` render testing. Use to verify a chart's template logic and rendered shape; this is unit-level correctness testing, not security scanning - to enforce policy on rendered manifests use policy-as-code-runner, and to scan charts for misconfigurations use checkov-policy or trivy-config.
policy-as-code-runner
Configures policy-as-code testing using OPA / Conftest / Cedar - authors policies in Rego (OPA's language), runs Conftest against Kubernetes manifests / Terraform plans / Dockerfiles / arbitrary structured data, integrates with CI for PR-time policy gates. Per OPA's docs: "an open source, general-purpose policy engine that unifies policy enforcement across the stack." Use to express + enforce custom policies (cost limits, tagging requirements, security baselines) that Checkov / tfsec / KICS don't cover.
trivy-config
Runs Trivy's misconfiguration scanner (`trivy config`) against IaC directories to detect security issues across Terraform, CloudFormation, Kubernetes manifests, Helm charts, Dockerfiles, and Azure ARM templates - installs Trivy, scans with severity gating via `--exit-code`, suppresses findings via `.trivyignore` / `.trivyignore.yaml` or inline annotations, extends built-in checks with custom Rego policies, and emits SARIF for GitHub Code Scanning. Trivy is the tfsec successor - the forward path from tfsec per Aqua Security's own migration guidance - and the legacy tfsec workflow (install, custom YAML rules, ignore annotations, migration steps) is kept in references/tfsec-legacy.md. Use when adopting a consolidated IaC scanner for new projects, migrating away from tfsec (or still operating a Terraform-only tfsec stack), or scanning mixed IaC stacks with a single tool.