Terraform Module Scanning

Prisma Cloud supports rendering and scanning both public, private, and locally cached Terraform modules (modules). This capability enables users to analyze misconfigurations that may result from the module definition and the variables defined in the module block.

Public and Locally Cached Modules

Automated support for public modules is provided by the platform for all version control system (VCS) repositories that have been onboarded. For information on onboarding repositories refer to Code Repositories.

Public and Local Module Scanning through Checkov CLI

When using the Checkov CLI (CLI), make sure to include the --download-external-modules true flag to enable the automatic download of external modules.

Additionally, the CLI supports scanning the .terraform directory when modules have been downloaded locally.

Nested modules are not yet supported in scans performed in the .terraform directory.

Private Module Support

Prisma Cloud supports the rendering and scanning of private modules through both CLI and VCS integrations. When using the CLI, refer to Scanning Third-Party Terraform Modules with Checkov CLI for instructions on including your API key, and optionally, the host.