PolicyGuard
IaC misconfiguration scanner for AWS and Azure Terraform and OpenTofu, with Rego policies that measure precision 1.00 / recall 0.95 on a committed benchmark, plus a hosted GUI and CI-ready CLI.
I wanted to understand how tools like Checkov and tfsec parse a 2000-line Terraform file in seconds and know that a public access block relates to its bucket. Adding custom policies to existing scanners felt like fighting the tool, and I learn more building the thing than complaining about it.
I wrote the scanner in Go on top of HashiCorp's own HCL library so parsing handles modules, interpolations, and OpenTofu without a homegrown parser to babysit; variable and module-input resolution is heuristic, so it sees through common indirection without needing a terraform plan or credentials. OPA and Rego evaluate every resource, each finding traces back to a readable policy with a CWE mapping and a diff-style remediation, and severities are tunable per policy so a team can align them with its own risk model. The hosted GUI reuses the same engine behind a public/local safety split: public mode is upload-only with tighter limits and no filesystem access, local mode binds to 127.0.0.1 for full-power scanning on your own machine.
A finding you can't trace back to a policy you can read isn't a finding, it's a guess.
PolicyGuard now covers AWS in depth (S3, EC2/EBS, IAM, RDS, KMS, and more) plus core Azure services, and the core policy set measures precision 1.00 / recall 0.95 (F1 0.98) on a committed benchmark corpus rather than an unverified claim.
- Rego policies with CWE mapping and diff-style remediation for every finding
- Benchmarked at precision 1.00 / recall 0.95 (F1 0.98) on a committed corpus
- Hosted GUI splits public upload-only mode from full local-machine scanning