agent-bom-scan-infra — Infrastructure & Cloud Security Scanner

Scans infrastructure-as-code (Terraform, CloudFormation, Kubernetes), finds secrets in config files, and runs cloud CIS benchmarks against AWS, Azure, GCP, and Snowflake.

Install

pipx install agent-bom
agent-bom iac infra/         # scan Terraform/CloudFormation/K8s
agent-bom cloud aws          # AWS CIS benchmark
agent-bom cloud azure        # Azure CIS benchmark
agent-bom cloud gcp          # GCP CIS benchmark
agent-bom secrets .          # find secrets in current directory

When to Use

• "check terraform" / "scan terraform"
• "scan kubernetes" / "K8s security"
• "IaC" / "infrastructure as code"
• "find secrets" / "secret scanning"
• "scan dockerfile"
• "cloud security" / "CIS benchmark"
• "misconfigurations"

Commands

# Scan IaC directory
agent-bom iac infra/

# Run cloud CIS benchmark
agent-bom cloud aws
agent-bom cloud azure
agent-bom cloud gcp
agent-bom cloud snowflake

# Find secrets in files
agent-bom secrets .

Tools

Tool	Description
iac	Scan Terraform, CloudFormation, Kubernetes YAML for misconfigurations
cloud	CIS benchmark checks (AWS, Azure v3.0, GCP v3.0, Snowflake)
secrets	Find secrets and credentials in files and directories

Examples

# Scan IaC directory for misconfigurations
iac(path="infra/")

# Run AWS CIS benchmark
cloud(provider="aws")

# Find secrets in project
secrets(path=".")

Guardrails

• Confirm with the user before running cloud CIS benchmarks — these make live read-only API calls to AWS/Azure/GCP using the user's locally configured credentials.