KICS is an open source solution for static code analysis of Infrastructure as Code.
Keeping Infrastructure as Code Secure (in short KICS) is a must-have for any cloud native project. With KICS, finding security vulnerabilities, compliance issues, and infrastructure misconfigurations happens early in the development cycle, when fixing these is straightforward and cheap.
It is as simple as running a CLI tool, making it easy to integrate into any project CI.
Support of other solutions and additional cloud providers are on the roadmap.
Setting up and using KICS is super-easy.
- First, see how to install and get KICS running.
- Next, check how you can easily integrate it into your CI for any project.
- Eventually, explore the output results format and quickly fix the issues detected.
What makes KICS really powerful and popular is its built-in extensibility. This extensibility is achieved by:
- Fully customizable and adjustable heuristics rules, called queries. These can be easily edited, extended and added.
- Robust but yet simple architecture, which allows quick addition of support for new Infrastructure as Code solutions.
KICS release process is quite simple. We have nightly builds that will pack and pre-release all changes merged into master. The nightly release will have a "nightly" prefix with the last commit hash code. We have binaries available for both Windows and Linux, as well a Docker image in DockerHub
KICS is a true community project. It's built as an open source from day one, and anyone can find his own way to contribute to the project.
Check out how, within just minutes, you can start making a difference, by sharing your expertise with a community of thousands of security experts and software developers.
KICS public documentation has all the project aspects covered.
Join the chat on Gitter.
Or contact KICS core team at kics@checkmarx.com
Keeping Infrastructure as Code Secure!
© 2021 Checkmarx Ltd. All Rights Reserved.