> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/infrastructure-as-code-iac-misconfiguration-scanner.md).

# Infrastructure as Code (IaC) misconfiguration scanner

IaC misconfiguration scanners safeguard your cloud infrastructure by identifying security risks and compliance violations in your Infrastructure as Code templates prior to deployment. By shifting security left, this closes the gap between code-time definitions and production-time security posture, preventing overly permissive policies, unencrypted buckets, or privileged containers from silently propagating into live environments.

The IaC Misconfigurations page consolidates all scanner-detected issues across monitored repositories into a single view where you can prioritize, investigate, remediate, and track SLA compliance.

### Supported frameworks and languages

Refer to [Supported frameworks and languages](/application-security/code-security/code-security-assets/infrastructure-as-code-iac-resources-as-assets/supported-frameworks-and-languages.md) for information.

## Workflows

* [Understand the IaC misconfigurations table](/application-security/code-security/code-security-scanners/infrastructure-as-code-iac-misconfiguration-scanner/understand-the-iac-misconfigurations-table.md)
* [Investigate, prioritize, and remediate IaC misconfiguration issues](/application-security/code-security/code-security-scanners/infrastructure-as-code-iac-misconfiguration-scanner/investigate-and-remediate-iac-misconfiguration-issues.md)
* [IaC misconfiguration findings](/application-security/code-security/code-security-scanners/infrastructure-as-code-iac-misconfiguration-scanner/iac-misconfiguration-findings.md)

## Prerequisites

| Prerequisite           | Description                                                                                                                                                                                                                                                            |
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| License                | An active Cortex Cloud license with Application Security add-on entitlements                                                                                                                                                                                           |
| RBAC Role              | The AppSec Admin or SOC Analyst role, or an equivalent custom role with issue management permissions. The Developer role grants read-only access                                                                                                                       |
| VCS Integration        | At least one Version Control System (GitHub, GitLab, Bitbucket, Azure DevOps) integrated and active                                                                                                                                                                    |
| IaC Scanner            | The IaC scanner enabled for the target repositories. For supported frameworks, see [Supported frameworks and languages](/application-security/code-security/code-security-assets/infrastructure-as-code-iac-resources-as-assets/supported-frameworks-and-languages.md) |
| Periodic or PR Scan    | At least one completed periodic scan or PR scan that includes IaC scanning results                                                                                                                                                                                     |
| YOR tags (for Urgency) | YOR trace tags applied to IaC resources. Without YOR tags, the Asset Lineage Graph cannot link the template to the deployed resource, and the deployment-dependent Urgency metrics cannot be computed                                                                  |

## Core achievements and use cases

* **Shifting security left and developer integration**: Detecting infrastructure misconfigurations at code-time, before cloud resources are provisioned, reduces the cost and risk of post-deployment remediation. IaC scans identify and flag critical issues such as insecure defaults and compliance violations directly within your IaC templates across various supported frameworks. This scanning integrates seamlessly into development workflows. Developers can detect findings locally using the Cortex CLI or directly within supported IDEs (Visual Studio Code, JetBrains) via plugins, providing real-time security feedback as they write code
* **Accelerating issue remediation**: Automated fix pull requests and manual fix guidance enable developers to resolve IaC misconfigurations directly in the source repository without context-switching to external tools. All Critical and High IaC misconfiguration findings are categorized as actionable issues. The platform streamlines remediation efforts by offering automated fixes that can modify the configuration directly
* **Reducing misconfiguration noise**: Urgency-based prioritization isolates the IaC misconfigurations that affect deployed, internet-exposed, or business-critical assets from low-risk findings in development environments
* **Establishing compliance baselines and policy enforcement**: Mapping IaC misconfigurations to detection rules (such as `CKV_K8S_16, CKV_AWS_1`) provides auditable evidence of compliance with CIS Benchmarks and organizational security policies. Furthermore, you can create and apply custom policies and rules that define how the system responds to IaC threats, allowing for tailored security checks and automated actions, such as blocking CI runs or pull requests based on detected misconfigurations


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/infrastructure-as-code-iac-misconfiguration-scanner.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.