Detecting Infrastructure Misconfigurations Using CoGuard: SAST for Terraform and IaC

Introduction Infrastructure as Code (IaC) is a modern approach to provisioning cloud infrastructure using tools like Terraform, Pulumi, or OpenTofu. These technologies improve scalability, repeatability, and automation—but they can also introduce security risks if the code is misconfigured. For example, exposing an S3 bucket to the public or disabling encryption can lead to serious data breaches. This article introduces CoGuard, a Static Application Security Testing (SAST) tool designed specifically to analyze configuration files used in infrastructure code. We’ll demonstrate how to scan Terraform code, interpret results, and automate the scanning process in a CI/CD workflow. What is CoGuard? CoGuard is a command-line static analysis tool for infrastructure configuration security. It detects insecure defaults and misconfigurations before deployment, aligning its findings with security frameworks like: CIS Benchmarks OWASP Cloud-Native Top 10 Internal security policies It supports a variety of IaC and system configuration formats, including: Terraform Kubernetes YAML Dockerfiles CloudFormation Apache/Nginx configs PostgreSQL, MySQL SSH, Linux services Unlike general-purpose SAST tools that analyze source code for logic flaws, CoGuard focuses on infrastructure and system-level misconfigurations, such as weak ACLs, missing encryption, and open network ports. Key Features Scans entire directories for misconfigured infrastructure files Highlights issues with severity levels and remediation advice Maps findings to recognized security standards (e.g., CIS, OWASP) Produces detailed reports in terminal or SARIF format Integrates with CI/CD tools like GitHub Actions or GitLab CI Installation and First Scan Step 1: Pull the Docker image docker pull coguard/coguard-cli Step 2: Run the scan on your Terraform project Make sure you're inside your Terraform project directory and run: docker run --rm -v $(pwd):/mnt coguard/coguard-cli scan /mnt This command mounts your local project and scans all infrastructure configuration files inside it. CoGuard will return a report showing any misconfigurations, their severity, and remediation advice. If you prefer a graphical user interface, you can also use CoGuard’s web platform to upload and analyze configuration files. Example: Vulnerable Terraform Code Here is a deliberately insecure main.tf file: resource "aws_s3_bucket" "example" { bucket = "open-bucket" acl = "public-read" } What CoGuard detects: Public access: The ACL public-read makes the bucket accessible to anyone. No encryption: There's no encryption configuration for data at rest. Missing versioning: There’s no versioning policy enabled. These issues are reported with their severity and are mapped to standards like the CIS AWS Foundations Benchmark v1.4 and OWASP Cloud-Native Application Security Top 10. CI/CD Integration You can integrate CoGuard into your deployment workflow using GitHub Actions: name: CoGuard Terraform Scan on: push: branches: [ "main" ] jobs: coguard-scan: runs-on: ubuntu-latest steps: - name: Checkout repository uses: actions/checkout@v3 - name: Run CoGuard run: | docker pull coguard/coguard-cli docker run --rm -v ${{ github.workspace }}:/mnt coguard/coguard-cli scan /mnt Exporting SARIF Reports You can export results in SARIF format for integration with GitHub Security Dashboard: docker run --rm -v $(pwd):/mnt coguard/coguard-cli scan /mnt --output-format sarif > report.sarif Results and Interpretation In a sample scan, CoGuard detected: 3 high-severity issues (e.g., public S3 bucket, unencrypted storage) 2 medium-severity issues (e.g., missing logging) 1 low-severity issue (e.g., missing metadata tags) Each result includes filename, line number, and clear remediation guidance. Conclusions CoGuard is a reliable SAST tool tailored for Infrastructure as Code. Its strengths include: Early detection of cloud misconfigurations Alignment with security benchmarks like CIS and OWASP Easy setup using Docker Seamless CI/CD integration Report generation for audits and dashboards By integrating CoGuard, teams can ensure secure and compliant infrastructure even before deployment. References CoGuard CLI GitHub CoGuard Web Platform CIS AWS Foundations Benchmark OWASP Cloud-Native Top 10

Apr 30, 2025 - 06:26

Detecting Infrastructure Misconfigurations Using CoGuard: SAST for Terraform and IaC

Introduction

Infrastructure as Code (IaC) is a modern approach to provisioning cloud infrastructure using tools like Terraform, Pulumi, or OpenTofu. These technologies improve scalability, repeatability, and automation—but they can also introduce security risks if the code is misconfigured. For example, exposing an S3 bucket to the public or disabling encryption can lead to serious data breaches.

This article introduces CoGuard, a Static Application Security Testing (SAST) tool designed specifically to analyze configuration files used in infrastructure code. We’ll demonstrate how to scan Terraform code, interpret results, and automate the scanning process in a CI/CD workflow.

What is CoGuard?

CoGuard is a command-line static analysis tool for infrastructure configuration security. It detects insecure defaults and misconfigurations before deployment, aligning its findings with security frameworks like:

CIS Benchmarks
OWASP Cloud-Native Top 10
Internal security policies

It supports a variety of IaC and system configuration formats, including:

Terraform
Kubernetes YAML
Dockerfiles
CloudFormation
Apache/Nginx configs
PostgreSQL, MySQL
SSH, Linux services

Unlike general-purpose SAST tools that analyze source code for logic flaws, CoGuard focuses on infrastructure and system-level misconfigurations, such as weak ACLs, missing encryption, and open network ports.

Key Features

Scans entire directories for misconfigured infrastructure files
Highlights issues with severity levels and remediation advice
Maps findings to recognized security standards (e.g., CIS, OWASP)
Produces detailed reports in terminal or SARIF format
Integrates with CI/CD tools like GitHub Actions or GitLab CI

Installation and First Scan

Step 1: Pull the Docker image

docker pull coguard/coguard-cli

Step 2: Run the scan on your Terraform project

Make sure you're inside your Terraform project directory and run:

docker run --rm -v $(pwd):/mnt coguard/coguard-cli scan /mnt

This command mounts your local project and scans all infrastructure configuration files inside it. CoGuard will return a report showing any misconfigurations, their severity, and remediation advice.

If you prefer a graphical user interface, you can also use CoGuard’s web platform to upload and analyze configuration files.

Example: Vulnerable Terraform Code

Here is a deliberately insecure main.tf file:

resource "aws_s3_bucket" "example" {
  bucket = "open-bucket"
  acl    = "public-read"
}

What CoGuard detects:

Public access: The ACL public-read makes the bucket accessible to anyone.
No encryption: There's no encryption configuration for data at rest.
Missing versioning: There’s no versioning policy enabled.

These issues are reported with their severity and are mapped to standards like the CIS AWS Foundations Benchmark v1.4 and OWASP Cloud-Native Application Security Top 10.

CI/CD Integration

You can integrate CoGuard into your deployment workflow using GitHub Actions:

name: CoGuard Terraform Scan

on:
  push:
    branches: [ "main" ]

jobs:
  coguard-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - name: Run CoGuard
        run: |
          docker pull coguard/coguard-cli
          docker run --rm -v ${{ github.workspace }}:/mnt coguard/coguard-cli scan /mnt

Exporting SARIF Reports

You can export results in SARIF format for integration with GitHub Security Dashboard:

docker run --rm -v $(pwd):/mnt coguard/coguard-cli scan /mnt --output-format sarif > report.sarif

Results and Interpretation

In a sample scan, CoGuard detected:

3 high-severity issues (e.g., public S3 bucket, unencrypted storage)
2 medium-severity issues (e.g., missing logging)
1 low-severity issue (e.g., missing metadata tags)

Each result includes filename, line number, and clear remediation guidance.

Conclusions

CoGuard is a reliable SAST tool tailored for Infrastructure as Code. Its strengths include:

Early detection of cloud misconfigurations
Alignment with security benchmarks like CIS and OWASP
Easy setup using Docker
Seamless CI/CD integration
Report generation for audits and dashboards

By integrating CoGuard, teams can ensure secure and compliant infrastructure even before deployment.