domains / families / security / scanning-iac-and-images-with-trivy

scanning-iac-and-images-with-trivy

separate

Scans container images, Infrastructure-as-Code (Terraform, CloudFormation,

When to use

• When integrating vulnerability and misconfiguration scanning into a CI/CD pipeline as a quality/security gate before images are pushed or infrastructure is applied.
• When auditing container images in a registry for known CVEs prior to deployment.
• When validating Terraform, CloudFormation, Kubernetes, Dockerfile, or Helm IaC for security misconfigurations.
• When generating an SBOM (CycloneDX/SPDX) for supply-chain transparency and later re-scanning that SBOM for newly disclosed CVEs.
• When scanning a running Kubernetes cluster for vulnerable workloads and misconfigured RBAC/resources.
• When enforcing license compliance policy on dependencies.

Skill page

Source