---
title: "Scan infrastructure code on every change · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/policy-as-code/scan-infrastructure-code
updated: 2026-10-20
licence: "All rights reserved"
---

# Scan infrastructure code on every change

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Policy as code](https://agentwranglers.se/playbook/infrastructure/policy-as-code)
- Rule: Run an infrastructure scanner on every pull request, and fail the build on any finding rated high or critical.
- How: Use a scanner such as Checkov or Trivy's `config` scan, which replaced tfsec. Both read Terraform, OpenTofu, CloudFormation, Kubernetes files and Dockerfiles. They know hundreds of common mistakes, such as public buckets and open ports. Pin the scanner's version, as you pin any tool in CI. Checkov fails on every failed check, not only high ones, so list accepted skips as in [let every exception expire](https://agentwranglers.se/playbook/infrastructure/policy-as-code/expiring-policy-exceptions).
- Check: Add a bucket with public read access in a test branch. The CI scan fails and names the resource.

Example:

```sh
trivy config --severity HIGH,CRITICAL --exit-code 1 infra/
checkov --directory infra/ --framework terraform --compact --quiet   # exit 1 on any failed check
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/policy-as-code/scan-infrastructure-code`.

- Next: [Test your own rules against the plan](https://agentwranglers.se/playbook/infrastructure/policy-as-code/policy-on-the-plan)
- [Policy as code](https://agentwranglers.se/playbook/infrastructure/policy-as-code)