KICS

KICS is an open-source static analyzer for Infrastructure as Code, aimed at teams that want security, compliance, and configuration checks in their repositories and pipelines. It suits organizations working across several IaC formats and CI systems, particularly those willing to tune policies in Rego. Terraform users should account for its stated limits on functions, environment variables, and unofficial or custom modules.

Overview

KICS scans Infrastructure as Code for security vulnerabilities, compliance problems, and misconfigurations before they reach deployment. Its broad format coverage includes Terraform, Kubernetes, Docker, AWS CloudFormation, Ansible, Helm, Google Deployment Manager, AWS SAM, Microsoft ARM, Azure Blueprints, OpenAPI, Pulumi, Crossplane, Knative, and Serverless Framework. That range makes it a practical common scanner for mixed estates rather than a tool tied to one cloud or one manifest language.

The project is powered by Checkmarx and uses OPA Rego for policy authoring. Policy testing and policy reporting are supported, while previous CIS certifications for AWS Foundations and Kubernetes benchmarks provide relevant benchmark context. Support is available through the core team’s email and GitHub Discussions, so users should expect a community- and project-oriented support model rather than a stated commercial service tier.

Key features

Adjustable queries

KICS includes security queries that can be edited, extended, and added. This is a meaningful advantage when default checks do not match an organization’s controls: security engineers can encode local standards instead of accepting a fixed rule set. The trade-off is governance work; teams need a process for reviewing and maintaining custom Rego policies.

Pipeline and editor coverage

Documented CI integrations span Azure Pipelines, Bamboo, Bitbucket Pipelines, CircleCI, Codefresh, GitHub Actions, GitLab CI, Jenkins, TeamCity, Travis, Terraform Cloud, AWS CodeBuild, pre-commit hooks, and AWS CDK. That breadth lets teams place scans at different points in delivery, from developer commits to hosted builds. A Visual Studio Code extension adds automatic scanning in the editor, which can catch issues before a pull request.

Installation and reporting

Run KICS as a Docker image, build it from source, or use downloadable releases for Linux, Windows, and macOS. Results can be exported as JSON, SARIF, GitLab SAST, JUnit, HTML, PDF, CycloneDX, ASFF, and CSV. The formats cover machine processing, CI security dashboards, test-report workflows, and documents for review, although the best choice depends on the systems already in your pipeline.

Terraform boundaries

KICS does not support Terraform functions or environment variables. It supports some listed official AWS Terraform modules but not unofficial or custom modules. Those constraints can leave meaningful gaps in codebases that rely heavily on computed values or internal module libraries, so Terraform teams should validate coverage against their actual module patterns before standardizing on KICS.

Pricing

KICS — free. KICS is described as a free open-source project. There is no free trial because the offering is already free, and no paid plans, seat charges, usage quotas, renewal terms, or free-plan caps are stated. This makes it suitable for individual developers and organizations that can operate an open-source scanner themselves, with infrastructure and policy-maintenance effort remaining their responsibility.

Platforms

KICS supports Linux, macOS, Windows, and self-hosted use. Docker and source builds provide deployment flexibility, while release downloads reduce setup work on the three desktop operating systems. Self-hosting fits teams that need scans inside their own build environment rather than a hosted service.

Who it's for

KICS is a strong fit for platform and security teams managing multiple IaC technologies, especially when CI coverage and export formats matter as much as detection. It also suits organizations that want to write and test their own Rego policies. It is a less comfortable choice for Terraform estates built around unsupported functions, environment variables, or unofficial and custom modules, unless those gaps are acceptable and separately controlled.

Pros and cons

Pros

• Broad IaC coverage: one scanner addresses cloud templates, Kubernetes, containers, and newer formats such as Pulumi and Crossplane.
• Custom policy control: editable, extendable queries and Rego support let teams align checks with internal requirements.
• Wide delivery integration: documented connections to major CI platforms, pre-commit, Terraform Cloud, and AWS CDK support varied workflows.
• Flexible outputs: SARIF, GitLab SAST, JUnit, and other formats help feed existing reporting and security systems.
• No license price: the open-source project costs nothing.

Cons

• Terraform coverage gaps: functions and environment variables are unsupported, and unofficial or custom modules are not covered.
• Operational ownership: self-hosted operation and custom-query maintenance require internal engineering effort.
• Support expectations: contact is through the core team and GitHub Discussions rather than a published paid support plan.

Alternatives

AWS CloudFormation is the better choice when your work is centered on AWS’s own template service and you want its freemium model; the service itself is free, while deployed AWS resources incur their own rates.

Conftest is a free, Apache 2.0-licensed option for testing configuration with policy checks when KICS’s multi-format scanner is broader than you need.

kube-score fits teams focused on Kubernetes manifest checks and wanting a free MIT-licensed project.

cfn-lint is preferable for dedicated AWS CloudFormation linting, with a free MIT-0-licensed tool supporting Python 3.10–3.14.

Chef InSpec is worth considering when you need a freemium compliance tool with a free non-production plan and a 30-day trial.

Cinc Auditor provides a free distribution of Chef InSpec for users who can work without formal warranties or support.

kubeconform is a free choice for Kubernetes schema validation without stated paid plans or usage limits.

OpenSCAP suits users seeking a free, open-source security-compliance toolset under the OpenSCAP umbrella.

For broader category browsing, see Infrastructure Testing Tools and Infrastructure Policy as Code Tools.

Verdict

Choose KICS if you need a free, self-hostable IaC scanner that spans many formats, plugs into established CI systems, and lets your team tailor Rego-based checks. Look elsewhere if your Terraform estate depends on unsupported functions, environment variables, or custom modules, or if you require a published commercial support commitment.