Cloud scanning

Active contributors: nikpivkin, Owen Rumney, knqyf263

Purpose

"Cloud scanning" in Trivy is the IaC misconfiguration scanner viewed from the cloud-provider angle. The IaC engine in pkg/iac/ ships normalized resource models for thirteen providers; rules expressed against those models work across Terraform, CloudFormation, ARM/Bicep, Helm, Kubernetes, Pulumi, and any future format that lands an adapter. This page summarizes the providers, what they cover, and where to look when adding a new service or rule.

For the engine internals, see IaC scanning. For the user-facing feature description, see misconfiguration scanning.

Provider catalog

pkg/iac/providers/
├── aws/             # 36 services (largest)
├── azure/           # 16 service families
├── google/          # 10 service families
├── digitalocean/
├── nifcloud/        # JP-specific cloud
├── oracle/
├── openstack/
├── cloudstack/
├── github/          # GitHub Actions / repository configuration
├── kubernetes/      # native K8s resources
├── dockerfile/      # not a cloud, but normalized as a "provider"
└── provider.go      # shared types

AWS

The AWS provider has the deepest coverage. Each subdirectory is one service (EC2, S3, IAM, RDS, EKS, ECR, etc.) and contains the resource shape (Bucket, Cluster, Distribution, ...). Adapters exist for Terraform and CloudFormation; the AWS Cloud Control adapter pattern is a more recent addition.

Azure

The Azure provider covers the heavy hitters: AppService, AuthZ (RBAC), Compute, Container (AKS, ACI, ACR), Database (SQL, MySQL, PostgreSQL, Cosmos), KeyVault, Monitor, Network, Security Center, Storage, Synapse. Adapters cover Terraform and ARM/Bicep.

Google Cloud

GCP coverage focuses on the most-attacked surfaces: BigQuery, Compute, DNS, IAM, KMS, Logging, SQL, Storage, GKE.

Niche providers

DigitalOcean, Nifcloud (Fujitsu Cloud), Oracle, OpenStack, CloudStack are present at varying coverage depth. Pull requests adding services are welcome and only require a new resource shape plus an adapter for at least one source format.

GitHub

The GitHub provider treats GitHub repositories as "cloud" infrastructure. It looks at workflow definitions, branch protection rules, and repository settings. This is what powers the GitHub Actions misconfiguration checks.

How a rule maps across formats

graph TD
    Rule[Rego rule:<br/>aws/s3/no_public_acls] --> Eval{evaluates against}
    Eval --> Shape[aws.S3.Buckets]
    Shape -->|adapter| TF[Terraform aws_s3_bucket]
    Shape -->|adapter| CF[CloudFormation AWS::S3::Bucket]
    Shape -->|adapter| Pulumi[Pulumi adapter]
    Shape -->|adapter| K8s[Kubernetes CRD adapter]

The single Rego rule never has to know about Terraform vs. CloudFormation. Adapters are responsible for filling aws.S3.Buckets regardless of source. This is the key payoff of the provider model.

Adding a new service

1. Pick the provider. Most additions are AWS or Azure.
2. Add the resource shape. pkg/iac/providers/<cloud>/<service>/<resource>.go defines the struct with iacTypes.Metadata on every field.
3. Update the state aggregate. pkg/iac/state/state.go adds a slice for the new resource on the cloud's struct.
4. Add adapters. At minimum, the Terraform adapter at pkg/iac/adapters/terraform/<cloud>/<service>/<resource>.go. CloudFormation/ARM/etc. as needed.
5. Contribute Rego rules upstream to trivy-checks. The bundle is consumed unchanged by Trivy.
6. Add tests. Each adapter has its own *_test.go. The IaC test suite is large (~91k lines including fixtures) and any addition must keep it green.

How findings reach the report

The same flow as any misconfiguration finding: local.Service (or the IaC scanner directly when invoked via trivy config) populates types.Result.Misconfigurations. Renderers and SARIF translate AVD IDs into machine-readable identifiers.

Integration points

• Misconfiguration scanning — feature-level overview.
• IaC scanning — engine internals.
• Kubernetes scanning — uses the kubernetes provider directly.

Key source files

File	Purpose
pkg/iac/providers/provider.go	Shared types.
pkg/iac/providers/aws/	AWS resource shapes.
pkg/iac/providers/azure/	Azure resource shapes.
pkg/iac/providers/google/	GCP resource shapes.
pkg/iac/state/state.go	Provider-state aggregate.
pkg/iac/adapters/<cloud>/<format>/	Format → state adapters.

See also

• IaC scanning — engine details.
• Misconfiguration scanning — feature summary.