Security
Context-Aware Infrastructure-as-Code Security
Evaluating static analysis for Terraform and Kubernetes — 29 runners, 1,346 Checkov rules — and studying how AST and graph context can reduce false positives.
Key results
- scanner runners evaluated
- 29
- Terraform, Kubernetes, CloudFormation and more
- Checkov security rules studied
- 1,346
- CKV rule set
- test suites
- 3,700+
- CI security gating with Bandit and secret scanners
Problem#
Static analysers such as Checkov and tfsec are good at spotting a risky attribute. They are much weaker at context: a rule looks at one resource without seeing what it is attached to or which boundary it sits behind. The result is alert fatigue — findings that are technically true but not exploitable — and missed issues that only appear across resources, such as multi-tier IAM misconfigurations.
My role#
Undergraduate researcher in the IaC Lab at the Faculty of IT, HCMUS.
Approach#
- Evaluated Checkov across 29 runners (Terraform, Kubernetes, CloudFormation, ...) and 1,346 CKV security rules to understand what is actually covered.
- Studied AST context propagation and graph-based analysis as ways to judge a resource together with the resources it connects to.
- Standardised findings as SARIF and CycloneDX/SPDX SBOMs so they can drive CI/CD security gates, and evaluated gating with Bandit and secret scanners across 3,700+ test suites.
Current work#
Curating a large, open IaC security dataset from public sources, with a classification taxonomy designed to be reused as a research benchmark.
Limitations — what this does not prove#
This is ongoing research. The numbers above describe the scope of the evaluation, not a detection-accuracy result; I will publish accuracy figures only once the dataset and benchmark are finished.