How to Scan Terraform for Misconfigurations Before You Apply
Terraform is how modern cloud infrastructure gets built — which makes it exactly where cloud misconfigurations get born. An open security group, a public storage bucket, or an over-permissive IAM policy in HCL becomes a live exposure on the next apply. ArcScan treats infrastructure-as-code as a first-class security surface across its whole lifecycle: author, apply, and drift.
Catch IaC misconfigurations before apply
ArcScan scans Terraform in CI, not after the fact. Drop the ArcScan CLI into your pipeline and it walks the repo, classifies every .tf, .yml, and Kubernetes manifest, and evaluates them against deterministic policy rules before the plan is ever applied. An .arcscan/policy.yml file checked in alongside your Terraform sets the fail-on threshold, rule exclusions, and scan paths, so the gate lives in the repo it governs. Terraform plans can be audited directly, and custom policy can be expressed in OPA/Rego or installed from the policy marketplace (CIS, SOC 2, ISO 27001, FedRAMP Moderate, CMMC Level 2, GDPR).
Separately, ArcScan's GitHub and GitLab webhooks auto-review YAML changed in a pull request and comment the findings back on the PR, and findings export as SARIF 2.1 so they annotate the diff natively in GitHub code scanning. When a fix is warranted, ArcScan can open a remediation pull request rather than just filing a finding.
Terraform state becomes a living CMDB
Shift-left is half the story; knowing what your IaC actually created is the other half. CI pipelines can post terraform show -json output to ArcScan's API after every apply. ArcScan ingests the state, upserts every compute instance it finds as a tracked asset correlated by cloud ID, backfills owning team, owner, and environment from tags, and can push the result to your ServiceNow CMDB automatically. State documents are never stored or logged: each resource is reduced to an explicit attribute allowlist, because terraform state holds secrets. Your asset inventory stops being a quarterly spreadsheet and starts being a side effect of your deploy pipeline.
Drift detection against known-good baselines
Infrastructure that started life in Terraform rarely stays that way. Console edits, break-glass changes, and forgotten experiments accumulate. Pin any cloud inventory snapshot as a known-good baseline and ArcScan re-scores every subsequent scan against it, alerting when the posture score drops or new critical findings appear. Console edits that widen your attack surface show up as a delta against the day you were clean, not as a surprise in the next audit. Drift that happens inside a declared change window is classified as intentional, and senior engineers can opt in to policy-selected reverse-sync playbooks that revert the rest, gated by maintenance windows, the automation-policy gate, and a per-sweep launch cap. That path is off by default.
Generate Terraform from what already exists
Working the other direction, ArcScan can draft Terraform from a live cloud snapshot, including a standard tag block that maps each resource to the business application it serves, downloadable per application as arcscan-tags-<app>.tf. The draft is AI-generated and meant as a starting point for review, not a drop-in replacement for your state. That gives teams a practical on-ramp to bringing click-ops infrastructure under IaC management with security review built in from the first commit.
Built for regulated DevOps
- Compliance mapping across 21 control packs including NIST 800-53, NIST 800-171, FedRAMP Low and Moderate, CIS, HIPAA, PCI-DSS, SOC 2, ISO 27001 and GDPR, with a crosswalk engine so evidence collected once maps across frameworks.
- ServiceNow integration for change requests, incidents, and CMDB sync, including change-request gating that blocks automation until the CR is approved. Jira and FreshService also supported.
- Artificial-intelligence analysis with governed, auditable remediation: blast radius computed before execution, check-mode dry run, dangerous-operations linting, and human approval before anything is applied. Terraform is a first-class remediation runner, not just a PR target. Every action is written to a hash-chained audit log.
- HMAC-signed evidence bundles that verify offline, plus a read-only external auditor portal over the tamper-evident log.
- Air-gapped Linux deployment and a FIPS-approved AES-256-GCM encryption mode for federal and defense cloud environments.