Agent WranglersPolicy as code Required
Scan infrastructure code on every change
Run an infrastructure scanner on every pull request, and fail the build on any finding rated high or critical.
How to do it
Use a scanner such as Checkov or Trivy's config scan, which replaced tfsec. Both read Terraform, OpenTofu, CloudFormation, Kubernetes files and Dockerfiles. They know hundreds of common mistakes, such as public buckets and open ports. Pin the scanner's version, as you pin any tool in CI. Checkov fails on every failed check, not only high ones, so list accepted skips as in let every exception expire.
Example
trivy config --severity HIGH,CRITICAL --exit-code 1 infra/
checkov --directory infra/ --framework terraform --compact --quiet # exit 1 on any failed checkHow to check
Add a bucket with public read access in a test branch. The CI scan fails and names the resource.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/policy-as-code/scan-infrastructure-code.