How to run SAST (Static security testing) of your infrastructure as code

Iac (Infrastructure as code) needs also static security testing. Static testing is the evaluation and testing of the code itself before any deployment of builds focusing on security configuration, best practices, and vulnerabilities. IaC can and might be considered as an application. So same efforts for scanning the code must go to Terraform, Cloudformation, ARM, and other infra.
In this video, I am showing you my vulnerable IaC lab where you will learn how to test your deployments before deployment even when you are not a cybersecurity professional. You will get a new DevSecOps superpower.
Links Github:
github.com/aqu...
github.com/bri...
github.com/acc...
Links to the docs:
snyk.io/produc...
tfsec.dev/
www.checkov.io...
Amazing article that we wrote with my former colleague:
www.revolgy.co...
====
Connect with me: / mareksottl
Blog: www.sottlmarek...
Subscribe here: / @hackitectsplayground

[@Moondreavus]

Hey, just want to let you know that I really enjoyed this video. This must've taken you a really long time to prepare, test and compare. Good job!

[@hackitectsplayground]

@Moondreavus Thank you! Every good vibe motivates me to make more. It's true that creation of such a videos is not easy and short task.

[@Ejdy_r]

HELL YEAAAH MAN!

[@hackitectsplayground]

I like your enthusiasm in this matter.

[@hackitectsplayground]

Whats your favourite SAST for Infra as code tool?