iac-policy-checker

checkov -d . -o json > checkov.json
tfsec . -f json -O tfsec.json
kics scan -p . --report-formats json --output-path kics/

interface Finding {
  scanner: 'checkov' | 'tfsec' | 'kics';
  rule_id: string;             // CKV_AWS_18, aws-s3-enable-encryption, ...
  severity: 'critical' | 'high' | 'medium' | 'low' | 'info';
  resource: string;             // aws_s3_bucket.public_data
  file: string;
  line: number;
  message: string;
  remediation?: string;
}

# scripts/iac-unify.py
import json

def normalize_checkov(data):
    findings = []
    for r in data.get('results', {}).get('failed_checks', []):
        findings.append({
            'scanner': 'checkov',
            'rule_id': r['check_id'],
            'severity': r.get('severity', 'medium').lower(),
            'resource': r.get('resource', ''),
            'file': r.get('file_path', ''),
            'line': r.get('file_line_range', [0])[0],
            'message': r.get('check_name', ''),
            'remediation': r.get('guideline'),
        })
    return findings

def normalize_tfsec(data):
    findings = []
    for r in data.get('results', []):
        findings.append({
            'scanner': 'tfsec',
            'rule_id': r['rule_id'],
            'severity': r['severity'].lower(),
            'resource': r['resource'],
            'file': r['location']['filename'],
            'line': r['location']['start_line'],
            'message': r['description'],
            'remediation': r.get('resolution'),
        })
    return findings

def normalize_kics(data):
    findings = []
    for q in data.get('queries', []):
        for f in q.get('files', []):
            findings.append({
                'scanner': 'kics',
                'rule_id': q['query_id'],
                'severity': q['severity'].lower(),
                'resource': f.get('resource_name', ''),
                'file': f['file_name'],
                'line': f['line'],
                'message': q['query_name'],
                'remediation': q.get('description'),
            })
    return findings

def dedupe(findings):
    seen = {}
    for f in findings:
        key = (f['file'], f['line'], normalize_issue_class(f['message']))
        if key not in seen or severity_rank(f['severity']) > severity_rank(seen[key]['severity']):
            seen[key] = f
            seen[key]['caught_by'] = seen[key].get('caught_by', []) + [f['scanner']]
    return list(seen.values())

# .iac-waivers.yaml
waivers:
  - scanner: checkov
    rule_id: CKV_AWS_20
    file: terraform/public-cdn.tf
    reason: "Public read access intentional for CDN distribution"
    expires: 2026-12-31
    approved_by: security-team

  - rule_id_pattern: 'CKV_K8S_*'
    file_pattern: 'helm/dev-overrides/*'
    reason: "Dev overrides; not production"
    expires: 2026-06-30

def apply_waivers(findings, waivers):
    out = []
    for f in findings:
        if not is_waived(f, waivers):
            out.append(f)
        else:
            print(f"Waived: {f['rule_id']} at {f['file']}:{f['line']}")
    return out

def verdict(findings, fail_on='high'):
    rank = {'critical': 4, 'high': 3, 'medium': 2, 'low': 1, 'info': 0}
    threshold = rank.get(fail_on, 3)
    blocking = [f for f in findings if rank.get(f['severity'], 0) >= threshold]
    return ('block', blocking) if blocking else ('pass', [])

## IaC policy review — `<sha>`

**Scanners:** Checkov 3.2.500, tfsec 1.28.13, KICS 2.0.10
**Total findings:** 47 (after deduplication)
**Waivers applied:** 3
**Verdict:** ❌ BLOCK — 4 high-severity findings

### High-severity (must fix)

| Severity | Resource                          | Finding                           | Caught by             |
|----------|-----------------------------------|-----------------------------------|-----------------------|
| critical | `aws_s3_bucket.data`               | Public ACL on bucket              | Checkov, tfsec, KICS  |
| high     | `aws_iam_policy.deploy`             | Action: "*" in policy             | Checkov, KICS         |
| high     | `aws_security_group_rule.app`       | Open to 0.0.0.0/0 on port 22       | tfsec, KICS           |
| high     | `aws_db_instance.orders`            | Encryption disabled               | Checkov               |

### Medium-severity (review)

(table)

### Low-severity / info

12 findings; full list in `iac-report.json`.

### Waived (3)

| Resource                  | Rule          | Reason                                | Expires    | Approved by   |
|---------------------------|---------------|---------------------------------------|------------|---------------|
| `aws_s3_bucket.cdn`        | CKV_AWS_20    | Public CDN; intentional                | 2026-12-31 | security-team |
| `helm/dev-overrides/*`     | CKV_K8S_*     | Dev only                                | 2026-06-30 | platform-team |

### Action items

1. **Fix the S3 bucket ACL.** Change `acl = "public-read"` to
   `private`; expose via CloudFront if needed.
2. **Narrow the IAM policy.** Replace `Action: "*"` with the
   specific actions.
3. **Restrict the security group rule.** Replace `0.0.0.0/0` with
   the specific source CIDR.
4. **Enable RDS encryption.** Add `storage_encrypted = true`.

After fixes, re-run the agent.

jobs:
  iac-policy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - run: |
          checkov -d . -o json > checkov.json
          tfsec . -f json -O tfsec.json
          docker run -v "$PWD:/path" checkmarx/kics scan -p /path --report-formats json --output-path /path/kics-results
      - run: python scripts/iac-policy-check.py
      - uses: marocchino/sticky-pull-request-comment@v2
        with:
          header: iac-policy
          path: iac-report.md