Agent Bom Scan Infra

agent-bom-scan-infra — Infrastructure & Cloud Security Scanner

Scans infrastructure-as-code (Terraform, CloudFormation, Kubernetes), finds secrets in config files, and runs cloud CIS benchmarks against AWS, Azure, GCP, and Snowflake.

Install

pipx install agent-bom
agent-bom iac infra/         # scan Terraform/CloudFormation/K8s
agent-bom cloud aws          # AWS CIS benchmark
agent-bom cloud azure        # Azure CIS benchmark
agent-bom cloud gcp          # GCP CIS benchmark
agent-bom scan --snowflake --snowflake-cis-benchmark
agent-bom secrets .          # find secrets in current directory

When to Use

• "check terraform" / "scan terraform"
• "scan kubernetes" / "K8s security"
• "IaC" / "infrastructure as code"
• "find secrets" / "secret scanning"
• "scan dockerfile"
• "cloud security" / "CIS benchmark"
• "misconfigurations"

Commands

# Scan IaC directory
agent-bom iac infra/

# Run cloud CIS benchmark
agent-bom cloud aws
agent-bom cloud azure
agent-bom cloud gcp
agent-bom scan --snowflake --snowflake-cis-benchmark

# Find secrets in files
agent-bom secrets .

Tools

Examples

# Scan IaC directory for misconfigurations
iac(path="infra/")

# Run AWS CIS benchmark
cloud(provider="aws")

# Find secrets in project
secrets(path=".")

Guardrails

• Confirm with the user before running cloud CIS benchmarks — these make live read-only API calls to AWS/Azure/GCP using the user's locally configured credentials.
• IaC and secrets scanning is purely local — no network calls.
• Do not modify any infrastructure files.
• Ask the user before scanning paths outside their home or project directory.
• Cloud credentials are used only to call the cloud provider's own APIs and are never transmitted elsewhere.