CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/kics-policy

Configures KICS (Keeping Infrastructure as Code Secure), Checkmarx's scanner covering Terraform, Kubernetes, Helm, Dockerfile, OpenAPI, Ansible, ARM, CloudFormation, Pulumi, Crossplane - CLI / Docker / GitHub Action / pre-commit, JSON / SARIF / HTML / JUnit output, custom Rego queries. Use for the widest platform breadth, especially OpenAPI / Pulumi / Crossplane; for the broadest built-in checks with Python custom rules use checkov-policy, for Terraform-only scanning use tfsec-policy, and for a consolidated scanner use trivy-config.

76

Quality

95%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files

kics-policy.mdreferences/

kics-policy - deep reference

Detail moved out of the SKILL.md spine to keep the core scan flow lean.

Pinned versions + binary install

Docker (docker pull checkmarx/kics:latest) is the primary path and carries no version pin. For a binary install, download the version-stamped release archive (v2.1.20 is the latest release as of 2026-07-20 - bump this pin when updating):

curl -sfL -o kics.tar.gz \
  https://github.com/Checkmarx/kics/releases/download/v2.1.20/kics_2.1.20_linux_amd64.tar.gz
tar -xzf kics.tar.gz && sudo mv kics /usr/local/bin/

Custom queries (Rego) - full template

KICS queries are written in Rego (same as OPA). A query lives in its own directory and uses the Cx package with a CxPolicy[result] rule:

# custom-queries/aws/cost_center_tag/query.rego
package Cx

CxPolicy[result] {
    resource := input.document[i].resource.aws_instance[name]
    not resource.tags.cost_center
    result := {
        "documentId": input.document[i].id,
        "searchKey": sprintf("aws_instance[%s]", [name]),
        "issueType": "MissingAttribute",
        "keyExpectedValue": "Should have a cost_center tag",
        "keyActualValue": "tags.cost_center is missing",
    }
}

Point KICS at the directory:

kics scan -p . -q ./custom-queries/

Anti-patterns

Anti-patternWhy it failsFix
KICS as only IaC scannerMisses Checkov / tfsec-specific findings.Use multiple scanners; combine results (CI step).
kics-scan ignore-line without comment justifyingSkips invisible.Always include reason.
Skipping --fail-on severity in CIAll findings (including LOW) fail; team disables.Start --fail-on high,critical.
Running on every PR with full outputOutput overwhelming; team ignores.Severity threshold + JSON/SARIF for triage.
Custom queries without testsBugs let bad config through.Test custom queries via OPA test pattern.

references

kics-policy.md

SKILL.md

tile.json