# 10 - Infrastructure as Code Scanning - IaC Security e Terraform Policy

Terraform scanning (Checkov, tfsec), CloudFormation/ARM security, misconfig detection, policy enforcement, secrets in IaC, best practices.

## What you'll learn

- Why IaC scanning is fundamental for cloud security
- Checkov: multi-framework IaC scanner
- tfsec: Terraform-specific analysis
- KICS: universal scanner by Checkmarx
- Custom policies for Terraform with Sentinel and Conftest

*This article is part of the **DevSecOps** series on federicocalo.dev.*

---

## Read the full article

The complete article (14 min read) with code examples, diagrams, and practical exercises is available here:

**➡️ [10 - Infrastructure as Code Scanning - IaC Security e Terraform Policy](https://federicocalo.dev/en/blog/iac-scanning-terraform-security)**

`https://federicocalo.dev/en/blog/iac-scanning-terraform-security`

---

*By [Federico Calò](https://federicocalo.dev) — Software Developer & Technical Writer*