How Trivy Catches Security Flaws in Dockerfiles and Terraform Before Deployment

Static Application Security Testing (SAST) tools can scan Infrastructure as Code (IaC) configuration files — such as Dockerfiles and Terraform scripts — to detect misconfigurations before any infrastructure is provisioned. In a walkthrough by developers Fabrizio Salvador and Elias Perez Peralta, Trivy, an open-source security scanner, was used to audit a sample containerized application managed via Terraform on AWS. A single command flagged three vulnerabilities: a container running as root, an unencrypted S3 bucket, and an SSH port exposed to the public internet. The team then remediated each issue by enforcing a non-root user, enabling AES-256 server-side encryption, and restricting SSH access to an internal VPN range. A follow-up Trivy scan confirmed all failures were resolved, demonstrating how SAST can be integrated into CI pipelines to enforce security standards early in development.