IaC Command Reference

The iac command runs a focused scan that evaluates only IaC Rego rules (rules with kind: iac) against Terraform HCL files. Nix files contribute component extraction (flake inputs) via the sca path — there are currently no Nix misconfiguration rules. It is equivalent to running:

vulnetix scan --evaluate-iac --no-sast --no-sca --no-secrets --no-containers --no-licenses

Package vulnerability analysis, general SAST rules, license analysis, secret detection, and container analysis are all disabled. Only rules that analyse Infrastructure as Code files run.

Credentials are optional. When no credentials are configured the community fallback is used automatically.

Usage

vulnetix iac [flags]

Flags

Flag	Type	Default	Description
`--path`	string	`.`	Directory to scan
`--depth`	int	`3`	Maximum recursion depth for file discovery
`--exclude`	stringArray	-	Exclude paths matching glob pattern (repeatable)
`-o, --output`	stringArray	-	Output target: `json-sarif` for stdout; `.sarif` file path for file output
`--no-progress`	bool	`false`	Suppress the progress bar
`--severity`	string	-	Exit `1` if any finding meets or exceeds: `low`, `medium`, `high`, `critical`
`--results-only`	bool	`false`	Only output when findings exist
`--dry-run`	bool	`false`	Report what this command would scan — rule kinds, external rule packs, discovered files — then replay stored results. Zero API calls.
`--list-default-rules`	bool	`false`	Print the built-in rule table and exit
`--snippet-context`	int	`-1`	Source lines captured around each SARIF finding (`-1` = dynamic, `0` disables)
`--iac-include-ignored`	bool	`false`	Include files matched by `.gitignore` (default: gitignored paths are skipped)

Detected File Types

The iac command scans files identified as IaC manifests:

Filename / Pattern	Language
`*.tf`	hcl (Terraform)
`flake.nix`	nix
`flake.lock`	nix

What Gets Detected

IaC rules check for common Terraform misconfigurations:

Rule ID	Severity	Name
VNX-TF-001	High	S3 bucket with public access enabled
VNX-TF-002	High	Security group with unrestricted ingress (0.0.0.0/0)
VNX-TF-003	High	IAM policy with wildcard resource or action
VNX-TF-004	Medium	RDS / Aurora instance not encrypted at rest
VNX-TF-005	Medium	CloudTrail logging not enabled
VNX-TF-006	Medium	EC2 instance metadata service v1 allowed (IMDSv1)
VNX-TF-007	Medium	EBS volume not encrypted
VNX-TF-008	High	Hardcoded secret or credential in Terraform resource

See the Terraform / IaC rules section for full details.

Examples

# IaC scan of the current directory
vulnetix iac

# Scan a specific Terraform project
vulnetix iac --path /path/to/terraform

# Break the build on high or critical IaC findings
vulnetix iac --severity high

# Emit SARIF JSON to stdout
vulnetix iac --output json-sarif

# Write SARIF to a file
vulnetix iac --output iac.sarif

# Silent when no issues found
vulnetix iac --results-only

# Exclude modules directory
vulnetix iac --exclude ".terraform/**"

Reading the output

The report is organised by resource, the thing you change in the file: aws_s3_bucket.logs, Deployment/api, module.net. The resource is read from the file after the scan: the nearest resource/data/module block above the line in Terraform, kind/metadata.name for the YAML document in Kubernetes, the service in a Compose file. A file with no such notion is listed under its path.

 ✖ IAC 7 problems on 3 resources in 4 files          4 need action · 3 can wait · 1 in tests
   9 findings · 2 folded as the same problem · 774 of 2865 rules ran

 NEEDS ACTION · 4 problems on 3 resources
 ────────────────────────────────────────────────────────────────────────────────────────────────
 aws_s3_bucket.logs  infra/storage.tf:12                                               2 problems
  ● HIGH      No server-side encryption        :12    TRIVY-S3-ENC
  ● HIGH      Bucket is publicly readable      :15    VNX-TF-001 · KICS-S3-ACL · REGULA-S3-1

Folding. Several rule packs often flag the same line. Two findings are one problem when they sit on the same line, on the same resource, and name the same weakness (the same CWE set); the row lists every rule that raised it. Findings with no CWE never fold, and a different weakness on the same line stays its own problem. -v folds nothing.

Group	What is in it
NEEDS ACTION	Resources with critical or high problems in production code.
CAN WAIT	Medium and low problems, one row per problem, with how many resources it is on. Seven are shown unless `-v`.
IN TESTS	Critical and high problems in test code, as files with a count. `--show tests` ranks them.
VENDORED	The same for `third_party/`, `vendor/` and similar trees.

Folding and grouping change only the terminal view; SARIF, JSON, uploads and gates see every finding at its own severity. --explain <file-path> shows every problem in a file with its lines, and --explain <rule-id> the rule and every place it fires.

Output Files

Path	Description
`.vulnetix/sast.sarif`	SARIF 2.1.0 report from IaC analysis
`.vulnetix/memory.yaml`	Scan state record (timestamp, finding counts, git context)

Exit Codes

Code	Meaning
`0`	Scan completed successfully (no threshold breach)
`1`	A gate was breached (`--severity`), or a fatal error occurred

Known false negatives

Detection is deliberately conservative — a missed detection is preferred over a wrong one. Not detected, by design:

Kubernetes manifest misconfigurations (privileged pods, hostPath mounts, missing limits) — the built-in rules cover Terraform only today.
Resources created through modules whose source is not vendored (only the calling block’s literals are visible).
Values resolved from variables, remote state, or workspaces — rules match literals, never evaluate HCL.

Absence of a finding is not verified absence of a misconfiguration.

vulnetix scan — Full scan with all features enabled
vulnetix sca — SCA-only scan
vulnetix sast — General SAST-only scan
vulnetix secrets — Secret detection only
vulnetix containers — Container file analysis only
Terraform / IaC Rules Reference — All 8 built-in IaC rules