Exploring KICS

KICS is another static code analysis tool, and like Checkov, it is open source. It is designed to help you find common misconfiguration issues, potential compliance issues, and even security vulnerabilities within your IaC code. It ships with support for Kubernetes, Docker, AWS CloudFormation, Terram, and, of course, Ansible, which we will be focusing on in this chapter.

KICS is designed to be easy to install, understand, and integrate into CI/CD pipelines. It includes over 2,400 customizable rules and is built for extensibility, allowing for the easy addition of support for new IaC tools and updates to existing integrations.

KICS is maintained and supported by Checkmarx specialists in software application security testing, meaning that KICS has a good pedigree.

Running the scan

Let’s dive straight in. If you haven’t already, check out the example repository using the following command:

$ git clone https://github.com/russmckendrick/Learn...