New Savings Proposals: approve, test and roll back cost changesLearn more Sign in|Talk to a cloud engineer
Product tourGet a demo

Fix the misconfig before it ships

CloudLens scans Terraform, CloudFormation and Kubernetes manifests with Trivy, in the pull request. A public bucket or an open security group is caught in the diff, with the file, the blast radius and the corrected snippet.

Get a demoSee all code security
What you're watchinglive product
  1. 1
    Scan the manifest, not just the cloud

    Trivy reads Terraform, CloudFormation and Kubernetes manifests in the pull request, so a misconfiguration is caught before it is applied.

  2. 2
    See the blast radius

    The finding explains what the setting exposes — a public log bucket is a data path, not just a style issue — so the fix is prioritised correctly.

  3. 3
    Copy the corrected snippet

    Each finding shows the offending HCL or YAML and the corrected version, such as a private ACL plus a public access block.

  4. 4
    Make it a required check

    Promote the rule to a required PR check so the same misconfiguration cannot merge again.

Who does thisPlatform or security engineer, with the team that owns the moduleWhat you getInfrastructure misconfigurations fixed in review, before they ever reach a live account.
3
0
formats: Terraform, CloudFormation, Kubernetes
In the PR
pre-merge
caught in the diff, before apply
Blast radius
shown
what the setting actually exposes
Fix
corrected
the fixed snippet, ready to paste

The public bucket was a one-line diff

Misconfigurations that are obvious in the manifest, but only get caught after they are live.

Timing

Caught in production, not in review

What usually happens: A posture tool flags the public bucket a day after apply, when fixing it means a change, a review and a redeploy.

How CloudLens resolves it: Trivy scans the manifest in the pull request, so the one-line misconfiguration never reaches a live account.

Resolved
Priority

A rule ID is not a risk

What usually happens: A finding reads “aws-s3-no-public-access” with no context, so it sits next to cosmetic warnings and gets ignored.

How CloudLens resolves it: The finding explains the blast radius — anyone can read a bucket that holds request logs — so the real risk is obvious.

Resolved
Fix

Knowing it is wrong is not knowing the fix

What usually happens: The developer sees the rule but has to work out the correct Terraform themselves, and guesses.

How CloudLens resolves it: The corrected snippet is in the finding view: set the ACL private and add a public access block, ready to paste.

Resolved

The offending line, the blast radius, the fix

Open the misconfiguration, read what it exposes, copy the corrected manifest — then file it.

From a manifest line to a corrected snippet

Cloud Security Posture Management
Open an IaC finding and you see the offending HCL or YAML, what it exposes, and the corrected version. File a Jira issue with the file, rule, blast radius and fix attached.
  • Terraform, CloudFormation and Kubernetes
  • The offending line and its blast radius
  • A corrected, paste-ready snippet
IaC is one engine of four

See every risk in your repositories in one view

Explore code security

How a public log bucket never made it to prod

A Thursday at Lumora Retail: a Terraform change to the logging module trips an IaC rule in review.

SRSahil RaoPlatform engineer, Lumora Retail

Lumora Retail is a fictional company. The people, names and numbers are sample data.

    1
    Thu 09:40Critical

    A Critical IaC finding lands on the PR

    The pull-request check flags “S3 bucket is publicly readable” at modules/logs/main.tf:12.
    2
    Thu 09:44

    Reads the blast radius

    The finding explains the bucket holds request logs and anyone on the internet could read it — a data path, not a style nit.
    3
    Thu 09:50

    Pastes the corrected snippet

    The ACL is set private and a public access block is added, exactly as the finding shows.
    4
    Thu 09:56SEC-127

    Files the trail and merges

    A Jira issue SEC-127 captures the file, rule and fix; the re-run check passes and the change merges safe.

Shift the cloud left into the diff

Before apply

The misconfiguration is caught in the manifest, in the pull request, so it never reaches a live account.

Blast radius, not rule IDs

Each finding explains what the setting exposes, so the one that matters stands out from the cosmetic ones.

Straight to a ticket

One click opens a Jira issue with the file, rule, blast radius and corrected snippet attached.

Cloud Security Posture Management Misconfigurations in your live cloud, across every account.
Secret Scanning Keys and tokens in code, history and files.
Code Security Every risk in your repositories, in one view.

IaC security questions

Terraform, CloudFormation and Kubernetes manifests, using Trivy. The scan runs on the files in your repository, in the pull request and on push.

IaC security checks the manifest before it is applied, so a misconfiguration is caught in the diff. CSPM checks the live cloud state after apply. The two complement each other — fix it in the PR with IaC, and verify the running account with CSPM.

Yes. Each finding shows the offending HCL or YAML, what it exposes, and the corrected snippet, so the developer can paste the fix rather than guess it.

Yes. Promote a rule to a required pull-request check, and a change that reintroduces that misconfiguration cannot merge.

Ready to see CloudLens in action?

Connect a read-only AWS role or Azure service principal. We'll walk you through your bill, your security graph and the first things worth fixing.