KICS (pronounced as 'kick-s') or Kicscan is an open source solution for static code analysis of Infrastructure as Code.

Keeping Infrastructure as Code Secure (in short KICS) is a must-have for any cloud native project. With KICS, finding security vulnerabilities, compliance issues, and infrastructure misconfigurations happens early in the development cycle, when fixing these is straightforward and cheap.

It is as simple as running a CLI tool, making it easy to integrate into any project CI.

Supported Platforms

KICS scans and detects issues in Terraform and Kubernetes infrastructure as code projects.
More solutions, such as AWS CloudFormation are on the roadmap.

Getting Started

Setting up and using KICS is super-easy.

• First, see how to install and get KICS running.
• Next, check how you can easily integrate it into your CI for any project.
• Eventually, explore the output results format and quickly fix the issues detected.

How it Works

What makes KICS really powerful and popular is its built-in extensibility. This extensibility is achieved by:

• Fully customizable and adjustable heuristics rules, called queries. These can be easily edited, extended, and added.
• Robust but yet simple architecture, which allows quick addition of support for new Infrastructure as Code solutions.

Contribution

KICS is a true community project. It's built as an open source from day one, and anyone can find his own way to contribute to the project.
Check out how, within just minutes, you can start making a difference, by sharing your expertise with a community of thousands of security experts and software developers.

More

KICS public documentation has all the project aspects covered.

Keep Infrastructure as Code Secure!

© 2020 Checkmarx Ltd. All Rights Reserved.