Scan IaC directory

Find misconfigurations in Terraform/Kubernetes/Helm code

trivy config --severity MEDIUM,HIGH,CRITICAL ./terraform
tool
trivy15 commands
tags
trivysecurityterraform

More trivy commands

  • Ignore unfixed CVEs
    trivy image --ignore-unfixed --severity HIGH,CRITICAL img:tag

    Skip vulnerabilities that have no fix available yet

  • Update vulnerability DB
    trivy image --download-db-only

    Pre-download the latest vulnerability database

  • Scan filesystem
    trivy fs .

    Scan the current directory for vulnerabilities

  • Scan Kubernetes cluster
    trivy k8s --report summary cluster

    Scan the entire Kubernetes cluster for vulnerabilities and misconfigs

  • Scan with SARIF output
    trivy image --format sarif --output results.sarif myimage:tag

    Output scan results in SARIF format for CI/IDE integration

all 15 trivy commands