IaC Security Scanner: Find Misconfigurations in Terraform and K8s
This hosted IaC security scanner runs Checkov 3.3.8 on a GitHub repository or a ZIP you upload and returns one row per failed policy, with the file, resource and line range, plus a JSON summary with a PASS, FAIL or UNKNOWN gate. It covers 20 formats including Terraform, Kubernetes, Helm, Dockerfile, CloudFormation and GitHub Actions, and is meant for platform, DevSecOps and cloud security teams who want scan results without running their own scanner.
Run it on Apify- $500.00 per 1,000 results
- 2 users in the last 30 days
- Export: JSON, CSV, Excel, API
- schemaVersion
- 2
- scanId
- 369b46f9d7f74f01b97df88735fb4933
- findingType
- IAC_MISCONFIGURATION
- policyProfile
- security
- framework
- terraform
- checkId
- CKV2_AWS_6
- checkName
- Ensure that S3 bucket has a Public Access block
- resource
- aws_s3_bucket.public_assets
- filePath
- main.tf
What you get
checkIdCheckov policy ID, for example CKV_AWS_20checkNamePlain-language name of the policy that failedframeworkIaC format that produced the finding, such as terraform or helmresourceName of the affected resource, such as an S3 bucket or a DeploymentfilePathRelative path of the file inside the scanned snapshotlineStartFirst affected line, or null when Checkov gives no rangelineEndLast affected line, or null when Checkov gives no rangecheckovCategoriesFull list of Checkov categories for the policyprimaryCategoryMain category, such as ENCRYPTION, IAM or LOGGINGseverityAlways UNRATED; no severity score is made upfindingFingerprintStable SHA-256 hash to track the same finding across runspolicyReferenceLink to the pinned Checkov source for the policygateDecisionIn OUTPUT: PASS, FAIL or UNKNOWN for your pipelinestatusIn OUTPUT: COMPLETED, COMPLETED_WITH_FINDINGS or FAILEDtotalFindingCountIn OUTPUT: full number of failed findings, even if rows were capped
What people use it for
Review a repository before a release
Point the scanner at a GitHub repository and a full commit SHA, choose the formats you use, and start the run. Sort the dataset by file and category to see which buckets, roles or containers need work. Because the commit is pinned, a rerun scans exactly the same files.
Pre-deployment gate in CI
Call the actor from your pipeline with the Apify API, then read gateDecision from the OUTPUT record. Stop the deploy on FAIL and send UNKNOWN to a person for a look. A sample GitHub Actions workflow is published in the examples repository.
Scheduled drift check
Save your input as an Apify Task and attach a schedule, for example every night on the main branch. Add a run-finished webhook so new findings land in your chat or ticket tool. Compare findingFingerprint values between runs to spot what is new.
One-off audit from a ZIP
When the code is not on GitHub, zip the infrastructure folder (up to 20 MiB) and upload it in the Console file picker. You get the same findings and summary without granting repository access. Export the dataset to Excel or CSV to share with the client.
Who it is for
- Platform engineers who review a Terraform or Kubernetes repository before it reaches production
- DevSecOps teams who add a pass or fail policy gate to a deployment pipeline through the Apify API
- Cloud security teams who run scheduled scans on infrastructure repositories to catch new misconfigurations
- Consultants and auditors who need a quick, read-only review of a client's IaC from a ZIP or a pinned commit
- Automation builders who send findings to their own tools through webhooks or an MCP client
How to run it
- Open IaC Security Misconfiguration Scanner API on Apify and sign in or create a free Apify account.
- Pick the source: paste a GitHub repository URL with an optional ref and folder, or upload a ZIP of your IaC files.
- Choose the IaC formats to scan, keep the security policy set or switch to all IaC policies, and set the dataset row limit.
- Click Start and wait for the run to finish; the scanner step itself is capped at 60 seconds.
- Open the dataset to read findings and export them as JSON, CSV or Excel, or fetch the dataset and OUTPUT record through the Apify API.
Pricing
You pay per result, through your Apify account: $500.00 per 1,000 results at the time of writing (2026-11-08). No subscription to this actor. Apify's free plan includes monthly platform credit, enough to test it. The current price is always the one shown on the Apify page.
Questions
Is it allowed to scan a GitHub repository with this tool?
Scan code you own or have permission to review. The actor only downloads a read-only archive snapshot of the repository: it does not clone, run hooks, follow submodules or change anything. For private repositories you supply a fine-grained token with read-only Contents access, and the token is kept out of the output and logs.
How much does an IaC security scan cost?
You pay per completed scan: $0.50 on the Apify Free plan, going down to $0.25 on the Diamond tier. The price is the same whether the scan finds zero problems or 500. A tiny actor start fee and Apify platform usage are added, and a scan that fails before results are saved is not charged the scan fee.
What formats can it scan?
It supports 20 Checkov frameworks: Terraform, Terraform JSON and Terraform Plan, Kubernetes, Helm, Kustomize, Dockerfile, AWS CloudFormation, AWS CDK, Serverless Framework, Azure ARM, Bicep, Ansible, OpenAPI, Argo Workflows, and the CI formats GitHub Actions, GitLab CI, Azure Pipelines, Bitbucket Pipelines and CircleCI.
In which formats can I export the results?
Findings are stored in an Apify dataset, which you can download as JSON, CSV, Excel and other formats from the Console or read through the API. The run summary is a JSON record called OUTPUT in the run's key-value store.
What are the limits?
ZIP uploads can be up to 20 MiB, with at most 500 files and 100 MiB uncompressed. The Checkov step has a 60-second timeout, and the dataset keeps up to 500 findings per scan, while OUTPUT still reports the full count. You can narrow a scan with a folder, fewer formats, or up to 100 specific Checkov IDs.
Is this a vulnerability scanner or a replacement for Checkov in CI?
No. It reports static policy misconfigurations in IaC files, not exploitable vulnerabilities, and it does not scan secrets, dependencies, container images or live cloud accounts. If you need pull-request comments, suppressions or custom checks, keep Checkov in your CI; this actor is a hosted batch scan.
Why is severity always UNRATED?
Checkov severity data requires a platform API key that this actor does not accept, so it does not invent a score. Treat UNRATED as unknown, not low, and triage by category, resource and policy name. Like any policy scanner, Checkov can produce false positives, so review each finding.