datadog-iac-scanner

module

v1.19.0 Latest Latest Go to latest Published: Sep 29, 2026 License: Apache-2.0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/DataDog/datadog-iac-scanner

Links

Open Source Insights

README ¶

Datadog IaC Scanner

This repository contains the source code of the Datadog IaC Scanner.

The scanner finds security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code. It produces standard SARIF output that can be integrated with Datadog or any other tool that consumes SARIF.

This project was forked from Checkmarx KICS.

Getting started

Download or build the binary.
Add a configuration file to your repository (optional).
Run the scanner.

Installation

Visit the releases page and download the binary archive for your operating system and architecture.

For Linux, choose the latest datadog-iac-scanner_linux_amd64.tar.gz (x86_64) or datadog-iac-scanner_linux_arm64.tar.gz (ARM64) file.
For macOS, choose the latest datadog-iac-scanner_darwin_amd64.tar.gz (Intel) or datadog-iac-scanner_darwin_arm64.tar.gz (Apple Silicon) file.
For Windows, choose the latest datadog-iac-scanner_windows_amd64.zip file.

Building from source

Clone the repository or download a source code archive from the releases page, then run:

make build

The binary will be available at bin/datadog-iac-scanner.

Usage

Scan the directory REPODIR and write SARIF output to OUTPUTDIR:

datadog-iac-scanner scan -p REPODIR -o OUTPUTDIR

REPODIR must be within a Git repository. You can also specify file names, or multiple directories and files, as long as they all reside in the same Git repository:

datadog-iac-scanner scan -p REPODIR/file1.yaml -p REPODIR/otherdir/file2.yaml -p REPODIR/anotherdir -o OUTPUTDIR

You can also use commas instead of repeating the -p flag:

datadog-iac-scanner scan -p REPODIR/file1.yaml,REPODIR/otherdir/file2.yaml,REPODIR/anotherdir -o OUTPUTDIR

By default, the output file is named datadog-iac-scanner-result.sarif. Use --output-name to specify a different name:

datadog-iac-scanner scan -p REPODIR -o OUTPUTDIR --output-name OUTPUTFILE.sarif

You can run the scanner using your own local rules, written in the QUERYDIR directory, with the -q flag:

datadog-iac-scanner scan -p REPODIR -o OUTPUTDIR -q QUERYDIR

The rule directories in the QUERYDIR directory must contain a 'query.rego' and a 'metadata.json' file. You can also specify multiple paths:

datadog-iac-scanner scan -p REPODIR -o OUTPUTDIR -q QUERYDIR1 -q QUERYDIR2

Run datadog-iac-scanner scan --help to see all available flags.

Configuring the scan

Create a file named code-security.datadog.yaml at the root of your repository to customize scanner behavior. Use this file to choose which rules run, restrict scanning to specific paths, or filter findings by severity and category.

schema-version: v1.2
iac:
  # Do not run these rules.
  ignore-rules:
    - A
    - B
  # Run only these rules. If set, all other rules are ignored.
  use-rules:
    - A
  global-config:
    # Only analyze the following paths/files.
    only-paths:
      - "infra/"
    # Do not analyze the following paths/files.
    ignore-paths:
      - "**/*.tfvars"
    # Do not report findings with these severities.
    ignore-severities:
      - info
      - low
    # Do not report findings in these categories.
    ignore-categories:
      - "Best Practices"

Replace placeholders such as A and B with Code Security rule IDs. For the full schema, see the IaC Security configuration documentation.

The legacy dd-iac-scan.config file is still supported for backwards compatibility, but its schema is deprecated and does not receive new updates. See legacy_config.md for its reference.

You can also use inline comments to exclude files, blocks, and individual lines from scan results. Add a comment containing dd-iac-scan followed by a command (prefixed with the comment syntax for the file format).

Comment	Description
`# dd-iac-scan ignore-line`	Ignores findings on the next line.
`# dd-iac-scan ignore-block`	Ignores findings in the following block.
`# dd-iac-scan ignore`	Ignores findings in the entire file. Must appear at the beginning of the file.
`# dd-iac-scan disable=<rule_id>`	Ignores findings for the specified rule. Must appear at the beginning of the file; applies to the whole file.
`# dd-iac-scan enable=<rule_id>`	Ignores findings for all rules except the specified rule. Must appear at the beginning of the file; applies to the whole file.

License

Datadog IaC Scanner is licensed under the Apache License, Version 2.0.

Acknowledgment

This project is based on KICS, developed by Checkmarx and released under the Apache License 2.0. It extends the original project with Datadog platform integration and additional rule coverage. For more details, see the Datadog IaC Security documentation.

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
cmd
custom-playground command Command custom-playground serves a small local web UI for exercising custom Rego validate/evaluate — the same logic the IaC rule editor uses via the backend.	Command custom-playground serves a small local web UI for exercising custom Rego validate/evaluate — the same logic the IaC rule editor uses via the backend.
scanner command
e2e
testcases
utils
internal
console * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
console/helpers * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
constants * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
memwatch Package memwatch records the process peak resident set size together with the scan phase it was reached in.	Package memwatch records the process peak resident set size together with the scan phase it was reached in.
metrics * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
pathutil
storage * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
tracker * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
pkg
analyzer * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
builder/engine * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
config
ctyutil
datadog * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
detector * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
detector/docker
detector/helm * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
detector/terraform * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
engine * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
engine/mock Package mock is a generated GoMock package.	Package mock is a generated GoMock package.
engine/provider * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
engine/source * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
featureflags
hclexpr * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
kuberneter Package kuberneter implements calls to the Kubernetes API in order to scan the runtime information of the resources	Package kuberneter implements calls to the Kubernetes API in order to scan the runtime information of the resources
logger
minified * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
model * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
parser * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
parser/ansible/ini/comments * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
parser/ansible/ini/config * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
parser/ansible/ini/hosts * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
parser/bicep * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
parser/bicep/antlr/parser
parser/buildah * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
parser/docker
parser/grpc * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
parser/grpc/converter * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
parser/json * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
parser/jsonfilter/parser * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
parser/terraform * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
parser/terraform/comment * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
parser/terraform/converter * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
parser/terraform/functions * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
parser/terraform/modules * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
parser/terraform/modules/modulegraph * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
parser/terraform/modules/moduleprepare * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
parser/terraform/modules/resolver * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
parser/terraform/registry * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
parser/terraform/tfeval Package tfeval evaluates local Terraform modules: bind inputs, resolve locals, recurse into nested modules, emit resources with concrete cty values where possible.	Package tfeval evaluates local Terraform modules: bind inputs, resolve locals, recurse into nested modules, emit resources with concrete cty values where possible.
parser/utils * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
parser/yaml * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
parser/yaml/cicd * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
parser/yaml/default * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
parser/yaml/dockercompose * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
parser/yaml/dockercompose/names Package names holds the default Docker Compose file names as a leaf package, shared by the Compose parser and the analyzer's classifier (which sit on opposite sides of an import cycle through pkg/parser/yaml), so both agree on which files are base files and which are auto-merged overrides.	Package names holds the default Docker Compose file names as a leaf package, shared by the Compose parser and the analyzer's classifier (which sit on opposite sides of an import cycle through pkg/parser/yaml), so both agree on which files are base files and which are auto-merged overrides.
platforms * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
printer * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
report * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
report/model * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
report/remediations
resolver * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
resolver/file
resolver/helm
runner * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
scan * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
scanner * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
server Package server implements a long-lived HTTP server that analyzes IaC files on demand.	Package server implements a long-lived HTTP server that analyzes IaC files on demand.
tfpath Package tfpath holds path predicates for Terraform/OpenTofu config files.	Package tfpath holds path predicates for Terraform/OpenTofu config files.
utils * Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.	* Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
vfs Package vfs abstracts the file-reading operations the scanner performs during cross-file resolution (Terraform sibling/variable globs, module directory reads, $ref includes).	Package vfs abstracts the file-reading operations the scanner performs during cross-file resolution (Terraform sibling/variable globs, module directory reads, $ref includes).
test