checkmarx/kicsStatic analysis scanner for infrastructure-as-code that detects security vulnerabilities, compliance violations, and misconfigurations across Terraform, Kubernetes, CloudFormation, and 20+ IaC platforms.
[](https://github.com/checkmarx/kics/releases) [](https://opensource.org/licenses/Apache-2.0) [](https://docs.kics.io/develop/queries/all-queries/) [](https://hub.docker.com/r/checkmarx/kics)  [](https://docs.kics.io/) [](https://github.com/Checkmarx/kics/discussions) [](https://sast.checkmarx.net/cxwebclient/portal#/projectState/702/Summary) [](https://www.codacy.com/gh/Checkmarx/kics/dashboard?utm_source=github.com&utm_medium=referral&utm_content=Checkmarx/kics&utm_campaign=Badge_Grade) [](https://sonarcloud.io/dashboard?id=Checkmarx_kics) [](https://goreportcard.com/report/github.com/Checkmarx/kics) [](https://docs.kics.io/coverage.html) <p align="center"> <img alt="KICS - Keep Infrastructure as Code Secure" src="https://assets.kitploit.com/production/public/readmes/4157/0ec2792139be31de270426a7d3739248b00125024ff141b93c74af7d1968d4c3.png" width="500"> <img alt="KICS - Keep Infrastructure as Code Secure" src="https://assets.kitploit.com/production/public/readmes/4157/d237a89c789e9fd6cb7e8fc50cf944af4ed2c20c3ca685b52083145b92a6f74c.png" width="500"> </p> --- <a href="https://www.kics.io" title="www.kics.io"><img src="https://assets.kitploit.com/production/public/readmes/4157/17f3e6c9ff3eaea92c881de34a475e37e28255b96d647c3822d124990e6cd00d.png" align="right"></a> Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with **KICS** by Checkmarx. **KICS** stands for **K**eeping **I**nfrastructure as **C**ode **S**ecure, it is open source and is a must-have for any cloud native project. ### Supported Platforms <br> <table align="center"><tr> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#terraform"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-terraform.png" alt="Terraform" width="120" /> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-terraform-dark.png" alt="Terraform" width="120" /> <img src="https://assets.kitploit.com/production/public/readmes/4157/c9aed37db24a037df333fa68bfb240bef06677fb81707d4ed0aa42c4b33e870a.png" alt="Terraform" width="120" /> </picture> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#kubernetes"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-k8s.png" width="160"> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-k8s-dark.png" width="160"> <img alt="Kubernetes" src="https://assets.kitploit.com/production/public/readmes/4157/0f7dc2964ac6fc627c6f3974396dad297399f8007c39a533be86217ee411508d.png" width="160"> </picture> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#docker"> <img alt="Docker" src="https://assets.kitploit.com/production/public/readmes/4157/d379475f78868d0abcc49ceeb006d3e2d69b362993af8a5f6fa3402258b95c56.png" width="180"> </a> </td> </tr></table> <table align="center"><tr> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#cloudformation"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-cf.png" width="150"> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-cf-dark.png" width="150"> <img alt="CloudFormation" src="https://assets.kitploit.com/production/public/readmes/4157/11943f9ad594b53d745ebfed145f04b642f80c3ed9dd0d6bf8e905047730e2ee.png" width="150"> </picture> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#ansible"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-ansible.png" width="150"> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-ansible-dark.png" width="150"> <img alt="Ansible" src="https://assets.kitploit.com/production/public/readmes/4157/8be56d581bb873a9d46c2e6af81232cd008eed2ccc16a5dc72b6ad140e6e72dd.png" width="150"> </picture> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#helm"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-helm-alt.png" width="60"> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-helm-dark.png" width="60"> <img alt="Helm" src="https://raw.githubusercontent.com/checkmarx/kics/HEAD/docs/img/logo-helm-alt" width="60"> </picture> </a> </td> </tr></table> <table align="center"><tr> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#openapi"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-openapi.png" width="185"> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-openapi-dark.png" width="185"> <img alt="OpenAPI" src="https://assets.kitploit.com/production/public/readmes/4157/f023afce142677647827c425a5bd12a290e030f93eb05d4311d1b64b2a0bf3d0.png" width="185"> </picture> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#grpc"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-grpc.png" width="135"> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-grpc-dark.png" width="135"> <img alt="gRPC" src="https://assets.kitploit.com/production/public/readmes/4157/33d05d15115afeecc306242969aa57809bb88d5c96961fdf3623e4c36ecf8dda.png" width="135"> </picture> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#azure-resource-manager"> <img alt="Azure Resource Manager" src="https://assets.kitploit.com/production/public/readmes/4157/453c771a5285452165dcc90ae0d85176491333a4158827316a033106304e825c.png" width="65" </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#google-deployment-manager"> <img alt="Google Deployment Manager" src="https://assets.kitploit.com/production/public/readmes/4157/b80bcf198a8c6b38e68876eb49ea9aa0f8a1e5c2677daa862a8940c67f3b20e2.png" width="65"> </a> </td> </tr></table> <table align="center"><tr> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#cdk"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-cdk.png" width="175"> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-cdk-dark.png" width="175"> <img alt="Cloud Development Kit" src="https://assets.kitploit.com/production/public/readmes/4157/0799f4388fe6367e83bbe43fb14c8a302a3876427dc68600d6eb2511f425aba2.png" width="175"> </picture> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#sam"> <img alt="SAM" src="https://assets.kitploit.com/production/public/readmes/4157/9c85e582cbcdc569d6a2a75f88f870cdb9efb602bdf5c16a6e95d276cd4e9761.png" width="65"> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#docker-compose"> <img alt="Docker Compose" src="https://assets.kitploit.com/production/public/readmes/4157/fa90abcf2020d64c1e4ff0c2df1f584e90a6b0ea75b1db23d4f78c8e81533b4e.png" width="95"> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#knative"> <img alt="Knative" src="https://assets.kitploit.com/production/public/readmes/4157/d5c77fdafba8052d6ff428ae867654ae3a26f3d646cf3ce601c6e604d71c7eab.png" width="85"> </a> </td> </tr></table> <table align="center"><tr> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#crossplane"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-crossplane.png" width="165"> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-crossplane-dark.png" width="165"> <img alt="Crossplane" src="https://assets.kitploit.com/production/public/readmes/4157/9e77f83ef5c263abc489f8f2fc77cd4df16b42e45b74cf542eebfe5ee01febe6.png" width="165"> </picture> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#pulumi"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-pulumi.png" width="145"> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-pulumi-dark.png" width="145"> <img alt="Pulumi" src="https://assets.kitploit.com/production/public/readmes/4157/33ca7fdd848d3747fa46eee3e8720d7d1c8c7bd0fe2de624bb1da6e93954125c.png" width="145"> </picture> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#serverlessfw"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-serverlessfw.png" width="170"> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-serverlessfw-dark.png" width="170"> <img alt="ServerlessFW" src="https://assets.kitploit.com/production/public/readmes/4157/53374068793be4b124738f49fe76b79a2c71575ac4ff63778d22d2f6a8495464.png" width="170"> </picture> </a> </td> </tr></table> <table align="center"><tr> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#azure-blueprints"> <img alt="Azure BluePrints" src="https://assets.kitploit.com/production/public/readmes/4157/a045f7d4df6d2856f945584f627bfe5b3d49193cad9c76a2a9b1c484ecbf8832.png" width="85"> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#cicd"> <img alt="GitHub Workflows" src="https://assets.kitploit.com/production/public/readmes/4157/3c8a02fc34f7a6669dbe52a4d176a18784ba0aeb86894cc091fe93662643d539.png" width="85"> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#terraform"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-opentofu.png" width="160"> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-opentofu-dark.png" width="160"> <img alt="OpenTofu" src="https://assets.kitploit.com/production/public/readmes/4157/7853c9897f5412ff55d29c53101d19a63fa041f87ceba59c950f60e5ec68113b.png" width="160"> </picture> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#bicep"> <img alt="Bicep" src="https://assets.kitploit.com/production/public/readmes/4157/b27077196f6cb4502899ad7e45ccec5320db680af3c12253149219b74a5fa2d2.png" width="85"> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#nifcloud-for-terraform"> <img alt="NIFCloud" src="https://assets.kitploit.com/production/public/readmes/4157/fc053534334a214a2854b7f0b1b3b14d71e4cd3a813eed237c5e345124a73a3a.png" width="110"> </a> </td> </tr> </table> <table align="center"><tr> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#databricks-for-terraform"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-databricks.png" width="200"> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-databricks-dark.png" width="200"> <img alt="Databricks" src="https://assets.kitploit.com/production/public/readmes/4157/e067cd215bba71a26012981d16fd136bfd50475b69b0f19721b77911b48b40c0.png" width="200"> </picture> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#tencentcloud-for-terraform"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-tencentcloud.png" width="180"> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-tencentcloud-dark.png" width="180"> <img alt="TencentCloud" src="https://assets.kitploit.com/production/public/readmes/4157/d99e18634b952a0798798e17baddf4331d650e98c5365e3f6ba0e08ae66453c1.png" width="180"> </picture> </a> </td> </tr> </table> ## Getting Started Setting up and using KICS is super-easy. - First, see how to [install and get KICS running](https://github.com/checkmarx/kics/blob/master/docs/getting-started.md). - Then explore KICS [output results format](https://github.com/checkmarx/kics/blob/master/docs/results.md) and quickly fix the issues detected. Interested in more advanced stuff? - Deep dive into KICS [queries](https://github.com/checkmarx/kics/blob/master/docs/queries.md). - Understand how to [integrate](https://github.com/checkmarx/kics/blob/master/docs/integrations.md) KICS in your favourite CI/CD pipelines. See [KICS documentation](https://docs.kics.io/) for more details and topics. ## How it Works What makes KICS really powerful and popular is its built-in extensibility. This extensibility is achieved by: - Fully customizable and adjustable heuristics rules, called [queries](https://github.com/checkmarx/kics/blob/master/docs/queries.md). These can be easily edited, extended and added. - Robust but yet simple [architecture](https://github.com/checkmarx/kics/blob/master/docs/architecture.md), which allows quick addition of support for new Infrastructure as Code solutions. ## Community You're welcome to join our [community](https://github.com/checkmarx/kics/blob/master/docs/community.md), talk with us on <a href="https://github.com/Checkmarx/kics/discussions" target="_blank">GitHub discussions</a> or contact KICS core team at [[email protected]](mailto:[email protected]). ### KICS Contributors See our individual contributors in the [community](https://github.com/checkmarx/kics/blob/master/docs/community.md) page. You're welcome to join them by [contributing](https://github.com/checkmarx/kics/blob/master/docs/CONTRIBUTING.md) to KICS. We also like to thank the following organizations for their ongoing contribution: - [Checkmarx](https://checkmarx.com/) - [Bedrock Streaming](https://bedrockstreaming.com/) (since v1.4.8) - [Dynatrace](https://www.dynatrace.com/) (since v1.5.1) - [Orca Security](https://orca.security/) (since v1.5.10) ### KICS Users KICS is used by various companies and organizations, some are listed below. If you would like to be included here please open a PR. - [Checkmarx](https://checkmarx.com/) ([IaC Security](https://checkmarx.com/product/iac-security/)) - [GitLab](https://gitlab.com/) ([Infrastructure as Code scanning](https://docs.gitlab.com/ee/user/application_security/iac_scanning/)) - [Bedrock Streaming](https://bedrockstreaming.com/) - [Cisco](https://www.panoptica.app/) ([CI/CD Securitry](https://docs.panoptica.app/docs/ci-cd-security)) - [Orca Security](https://orca.security/) - [JIT](https://www.jit.io/) ([SAST for IaC](https://www.jit.io/security-tools/kics)) - [Firefly](https://www.firefly.ai/) ([Firefly Integrates With Checkmarx's KICS](https://www.firefly.ai/blog/firefly-integrates-with-checkmarxs-kics-to-enable-seamless-cloud-governance-from-code-to-cloud)) - [Redpanda](https://redpanda.com/) - [Keptn](https://github.com/keptn) / [Keptn Lifecycle Toolkit](https://keptn.sh) **Keeping Infrastructure as Code Secure!** --- © 2026 Checkmarx Ltd. All Rights Reserved.
