checkmarx/kics用于基础设施即代码的静态分析扫描工具，可检测Terraform、Kubernetes、CloudFormation以及20多个IaC平台中的安全漏洞、合规违规和错误配置。
[](https://github.com/checkmarx/kics/releases) [](https://opensource.org/licenses/Apache-2.0) [](https://docs.kics.io/develop/queries/all-queries/) [](https://hub.docker.com/r/checkmarx/kics)  [](https://docs.kics.io/) [](https://github.com/Checkmarx/kics/discussions) [](https://sast.checkmarx.net/cxwebclient/portal#/projectState/702/Summary) [](https://www.codacy.com/gh/Checkmarx/kics/dashboard?utm_source=github.com&utm_medium=referral&utm_content=Checkmarx/kics&utm_campaign=Badge_Grade) [](https://sonarcloud.io/dashboard?id=Checkmarx_kics) [](https://goreportcard.com/report/github.com/Checkmarx/kics) [](https://docs.kics.io/coverage.html) <p align="center"> <img alt="KICS - 保持基础设施即代码安全" src="https://assets.kitploit.com/production/public/readmes/4157/0ec2792139be31de270426a7d3739248b00125024ff141b93c74af7d1968d4c3.png" width="500"> <img alt="KICS - 保持基础设施即代码安全" src="https://assets.kitploit.com/production/public/readmes/4157/d237a89c789e9fd6cb7e8fc50cf944af4ed2c20c3ca685b52083145b92a6f74c.png" width="500"> </p> --- <a href="https://www.kics.io" title="www.kics.io"><img src="https://assets.kitploit.com/production/public/readmes/4157/17f3e6c9ff3eaea92c881de34a475e37e28255b96d647c3822d124990e6cd00d.png" align="right"></a> 使用 Checkmarx 的 **KICS**，在基础设施即代码的开发周期早期发现安全漏洞、合规问题和基础设施配置错误。 **KICS** 代表 **K**eeping **I**nfrastructure as **C**ode **S**ecure（保持基础设施即代码安全），它是开源的，是任何云原生项目的必备工具。 ### 支持的平台 <br> <table align="center"><tr> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#terraform"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-terraform.png" alt="Terraform" width="120" /> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-terraform-dark.png" alt="Terraform" width="120" /> <img src="https://assets.kitploit.com/production/public/readmes/4157/c9aed37db24a037df333fa68bfb240bef06677fb81707d4ed0aa42c4b33e870a.png" alt="Terraform" width="120" /> </picture> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#kubernetes"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-k8s.png" alt="Kubernetes" width="160"> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-k8s-dark.png" alt="Kubernetes" width="160"> <img alt="Kubernetes" src="https://assets.kitploit.com/production/public/readmes/4157/0f7dc2964ac6fc627c6f3974396dad297399f8007c39a533be86217ee411508d.png" width="160"> </picture> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#docker"> <img alt="Docker" src="https://assets.kitploit.com/production/public/readmes/4157/d379475f78868d0abcc49ceeb006d3e2d69b362993af8a5f6fa3402258b95c56.png" width="180"> </a> </td> </tr></table> <table align="center"><tr> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#cloudformation"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-cf.png" alt="CloudFormation" width="150"> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-cf-dark.png" alt="CloudFormation" width="150"> <img alt="CloudFormation" src="https://assets.kitploit.com/production/public/readmes/4157/11943f9ad594b53d745ebfed145f04b642f80c3ed9dd0d6bf8e905047730e2ee.png" width="150"> </picture> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#ansible"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-ansible.png" alt="Ansible" width="150"> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-ansible-dark.png" alt="Ansible" width="150"> <img alt="Ansible" src="https://assets.kitploit.com/production/public/readmes/4157/8be56d581bb873a9d46c2e6af81232cd008eed2ccc16a5dc72b6ad140e6e72dd.png" width="150"> </picture> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#helm"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-helm-alt.png" alt="Helm" width="60"> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-helm-dark.png" alt="Helm" width="60"> <img alt="Helm" src="https://raw.githubusercontent.com/checkmarx/kics/HEAD/docs/img/logo-helm-alt" width="60"> </picture> </a> </td> </tr></table> <table align="center"><tr> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#openapi"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-openapi.png" alt="OpenAPI" width="185"> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-openapi-dark.png" alt="OpenAPI" width="185"> <img alt="OpenAPI" src="https://assets.kitploit.com/production/public/readmes/4157/f023afce142677647827c425a5bd12a290e030f93eb05d4311d1b64b2a0bf3d0.png" width="185"> </picture> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#grpc"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-grpc.png" alt="gRPC" width="135"> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-grpc-dark.png" alt="gRPC" width="135"> <img alt="gRPC" src="https://assets.kitploit.com/production/public/readmes/4157/33d05d15115afeecc306242969aa57809bb88d5c96961fdf3623e4c36ecf8dda.png" width="135"> </picture> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#azure-resource-manager"> <img alt="Azure Resource Manager" src="https://assets.kitploit.com/production/public/readmes/4157/453c771a5285452165dcc90ae0d85176491333a4158827316a033106304e825c.png" width="65" </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#google-deployment-manager"> <img alt="Google Deployment Manager" src="https://assets.kitploit.com/production/public/readmes/4157/b80bcf198a8c6b38e68876eb49ea9aa0f8a1e5c2677daa862a8940c67f3b20e2.png" width="65"> </a> </td> </tr></table> <table align="center"><tr> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#cdk"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-cdk.png" alt="Cloud Development Kit (CDK)" width="175"> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-cdk-dark.png" alt="Cloud Development Kit (CDK)" width="175"> <img alt="Cloud Development Kit (CDK)" src="https://assets.kitploit.com/production/public/readmes/4157/0799f4388fe6367e83bbe43fb14c8a302a3876427dc68600d6eb2511f425aba2.png" width="175"> </picture> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#sam"> <img alt="SAM" src="https://assets.kitploit.com/production/public/readmes/4157/9c85e582cbcdc569d6a2a75f88f870cdb9efb602bdf5c16a6e95d276cd4e9761.png" width="65"> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#docker-compose"> <img alt="Docker Compose" src="https://assets.kitploit.com/production/public/readmes/4157/fa90abcf2020d64c1e4ff0c2df1f584e90a6b0ea75b1db23d4f78c8e81533b4e.png" width="95"> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#knative"> <img alt="Knative" src="https://assets.kitploit.com/production/public/readmes/4157/d5c77fdafba8052d6ff428ae867654ae3a26f3d646cf3ce601c6e604d71c7eab.png" width="85"> </a> </td> </tr></table> <table align="center"><tr> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#crossplane"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-crossplane.png" alt="Crossplane" width="165"> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-crossplane-dark.png" alt="Crossplane" width="165"> <img alt="Crossplane" src="https://assets.kitploit.com/production/public/readmes/4157/9e77f83ef5c263abc489f8f2fc77cd4df16b42e45b74cf542eebfe5ee01febe6.png" width="165"> </picture> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#pulumi"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-pulumi.png" alt="Pulumi" width="145"> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-pulumi-dark.png" alt="Pulumi" width="145"> <img alt="Pulumi" src="https://assets.kitploit.com/production/public/readmes/4157/33ca7fdd848d3747fa46eee3e8720d7d1c8c7bd0fe2de624bb1da6e93954125c.png" width="145"> </picture> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#serverlessfw"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-serverlessfw.png" alt="Serverless Framework" width="170"> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-serverlessfw-dark.png" alt="Serverless Framework" width="170"> <img alt="Serverless Framework" src="https://assets.kitploit.com/production/public/readmes/4157/53374068793be4b124738f49fe76b79a2c71575ac4ff63778d22d2f6a8495464.png" width="170"> </picture> </a> </td> </tr></table> <table align="center"><tr> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#azure-blueprints"> <img alt="Azure Blueprints" src="https://assets.kitploit.com/production/public/readmes/4157/a045f7d4df6d2856f945584f627bfe5b3d49193cad9c76a2a9b1c484ecbf8832.png" width="85"> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#cicd"> <img alt="GitHub Workflows" src="https://assets.kitploit.com/production/public/readmes/4157/3c8a02fc34f7a6669dbe52a4d176a18784ba0aeb86894cc091fe93662643d539.png" width="85"> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#terraform"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-opentofu.png" alt="OpenTofu" width="160"> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-opentofu-dark.png" alt="OpenTofu" width="160"> <img alt="OpenTofu" src="https://assets.kitploit.com/production/public/readmes/4157/7853c9897f5412ff55d29c53101d19a63fa041f87ceba59c950f60e5ec68113b.png" width="160"> </picture> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#bicep"> <img alt="Bicep" src="https://assets.kitploit.com/production/public/readmes/4157/b27077196f6cb4502899ad7e45ccec5320db680af3c12253149219b74a5fa2d2.png" width="85"> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#nifcloud-for-terraform"> <img alt="NIFCloud" src="https://assets.kitploit.com/production/public/readmes/4157/fc053534334a214a2854b7f0b1b3b14d71e4cd3a813eed237c5e345124a73a3a.png" width="110"> </a> </td> </tr> </table> <table align="center"><tr> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#databricks-for-terraform"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-databricks.png" alt="Databricks" width="200"> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-databricks-dark.png" alt="Databricks" width="200"> <img alt="Databricks" src="https://assets.kitploit.com/production/public/readmes/4157/e067cd215bba71a26012981d16fd136bfd50475b69b0f19721b77911b48b40c0.png" width="200"> </picture> </a> </td> <td> <a href="https://github.com/Checkmarx/kics/blob/master/docs/platforms.md#tencentcloud-for-terraform"> <picture> <source media="(prefers-color-scheme: light)" srcset="docs/img/logo-tencentcloud.png" alt="Tencent Cloud" width="180"> <source media="(prefers-color-scheme: dark)" srcset="docs/img/logo-tencentcloud-dark.png" alt="Tencent Cloud" width="180"> <img alt="Tencent Cloud" src="https://assets.kitploit.com/production/public/readmes/4157/d99e18634b952a0798798e17baddf4331d650e98c5365e3f6ba0e08ae66453c1.png" width="180"> </picture> </a> </td> </tr> </table> ## 快速开始 设置和使用 KICS 非常简单。 - 首先，查看如何 [安装并运行 KICS](https://github.com/checkmarx/kics/blob/master/docs/getting-started.md)。 - 然后，探索 KICS [输出结果格式](https://github.com/checkmarx/kics/blob/master/docs/results.md)，并快速修复检测到的问题。 对更高级的内容感兴趣？ - 深入了解 KICS [查询](https://github.com/checkmarx/kics/blob/master/docs/queries.md)。 - 了解如何将 KICS [集成](https://github.com/checkmarx/kics/blob/master/docs/integrations.md) 到你最喜爱的 CI/CD 流水线中。 更多详细信息和主题，请参阅 [KICS 文档](https://docs.kics.io/)。 ## 工作原理 KICS 真正强大和流行的原因在于其内置的可扩展性。这种可扩展性通过以下方式实现： - 完全可定制和可调整的启发式规则，称为 [queries](https://github.com/checkmarx/kics/blob/master/docs/queries.md)。这些规则可以轻松编辑、扩展和添加。 - 健壮但简单的 [架构](https://github.com/checkmarx/kics/blob/master/docs/architecture.md)，可以快速添加对新的基础设施即代码解决方案的支持。 ## 社区 欢迎加入我们的 [社区](https://github.com/checkmarx/kics/blob/master/docs/community.md)，在 <a href="https://github.com/Checkmarx/kics/discussions" target="_blank">GitHub Discussions</a> 上与我们交流，或通过 [[email protected]](mailto:[email protected]) 联系 KICS 核心团队。 ### KICS 贡献者 在 [社区](https://github.com/checkmarx/kics/blob/master/docs/community.md) 页面查看我们的个人贡献者。欢迎通过 [贡献](https://github.com/checkmarx/kics/blob/master/docs/CONTRIBUTING.md) KICS 加入他们。 我们还要感谢以下组织的持续贡献： - [Checkmarx](https://checkmarx.com/) - [Bedrock Streaming](https://bedrockstreaming.com/) (自 v1.4.8) - [Dynatrace](https://www.dynatrace.com/) (自 v1.5.1) - [Orca Security](https://orca.security/) (自 v1.5.10) ### KICS 用户 KICS 被多家公司和组织使用，部分列出如下。如果你希望包含在此，请提交一个 PR。 - [Checkmarx](https://checkmarx.com/) ([IaC Security](https://checkmarx.com/product/iac-security/)) - [GitLab](https://gitlab.com/) ([Infrastructure as Code scanning](https://docs.gitlab.com/ee/user/application_security/iac_scanning/)) - [Bedrock Streaming](https://bedrockstreaming.com/) - [Cisco](https://www.panoptica.app/) ([CI/CD Security](https://docs.panoptica.app/docs/ci-cd-security)) - [Orca Security](https://orca.security/) - [JIT](https://www.jit.io/) ([SAST for IaC](https://www.jit.io/security-tools/kics)) - [Firefly](https://www.firefly.ai/) ([Firefly Integrates With Checkmarx's KICS](https://www.firefly.ai/blog/firefly-integrates-with-checkmarxs-kics-to-enable-seamless-cloud-governance-from-code-to-cloud)) - [Redpanda](https://redpanda.com/) - [Keptn](https://github.com/keptn) / [Keptn Lifecycle Toolkit](https://keptn.sh) **保持基础设施即代码安全！** --- © 2026 Checkmarx Ltd. 保留所有权利。
