Checkov SAST Tool Cuts Terraform Stack Failures from 36 to 6 After Remediation

Security misconfigurations in Infrastructure as Code (IaC) pose the same production risks as application bugs, yet standard Terraform validation tools do not catch them. Checkov, an open-source static analysis tool, was applied to a realistic Terraform stack provisioning S3, RDS, IAM, and networking resources, initially flagging 36 failed security checks against 14 passed. After remediating all findings that represented genuine exploitable risks — including a publicly readable S3 bucket, open SSH ingress, unencrypted RDS storage, and a wildcard IAM policy — the stack passed 57 checks. The 6 remaining failures were identified as deliberate business decisions, such as replication and lifecycle policies, rather than security vulnerabilities. The exercise highlights that IaC scanners like Checkov evaluate intended infrastructure state rather than code syntax, filling a critical gap that standard provider validation leaves open.