The misconfiguration caught in the plan,
before it becomes a posture finding.
Datadog IaC Security reads the Terraform, CloudFormation, Kubernetes and Docker files on every commit. It comments on the pull request when a change would create a public bucket, an open security group or a privileged container. We connect the infrastructure repositories, choose the rules for each provider, add the rules that are specific to your platform, and operate it every month alongside the posture findings it is meant to prevent.
Quick facts
Related
- Cloud Security Posture Management, the same checks, after the apply
- Code Security, the group this belongs to
- Secret Scanning, for the credential in the Terraform variable
The same finding, a week earlier, and in the place where it is one line to fix
A public bucket found in the cloud account is an incident with a change window. The same bucket found in the Terraform that would have created it is a comment on a pull request, resolved by the person who wrote it, before the plan runs. Nothing about the finding changed. The time and the cost of fixing it did.
Every commit, every branch, every connected repository. The scan runs on the infrastructure files as they change, not on a schedule. A branch that was opened on Monday and merged on Thursday was scanned on both days.
The comment on the resource block. Inline on the pull request, on the line that declares the resource, with a suggested fix where one applies. A remediation pull request can be opened from Datadog for the developer to review.
Gates that report to the source host. PR Gates send a pass or fail status to GitHub or Azure DevOps. Informational by default. Blocking when the team has agreed which severities nobody merges.
Rules for your platform, not only the generic ones. Built-in rules cover the provider misconfigurations. Custom rules encode the standard that is yours: the mandatory tag, the customer-managed key, the region list, the naming convention.
A module the scanner cannot resolve, a gate on medium severity, and two tools reporting one bucket
How it bills. IaC Security is part of Code Security and is billed per committer, per month, on its own or in the Code Security bundle that includes it. Datadog counts a committer as an active Git author, identified by email address, who commits at least three times in the month. Datadog publishes the bundles, meters and rates. The lever is still the repository list. A fork of a public module library adds findings in code you do not apply.
The configuration traps. Terraform that references a module from a private registry the scanner cannot reach, so the rule sees a variable name where the value would be and the finding never fires. Every supported rule running by default across every repository, with no exclusions scoped to what each team owns, so the findings that matter sit in a list padded with ones nobody will act on. PR Gates made blocking on medium severity before the platform team has reviewed the results, so a routine change is held by a tag check and the gate is disabled. IaC findings and posture findings reported in two lists with no reconciliation, so the public bucket is counted twice and fixed in neither. A Helm chart scanned without its dependent charts in the directory, so the rendered manifests are never what the scan saw.
Field noteThe most common gap we see is that the infrastructure repository is scanned and the environment is not built from it. The staging account was created by hand two years ago. The Terraform describes an intention. The posture findings describe what is there, and the two have never been compared.
Field noteThe pattern we keep finding is a platform standard that exists as a wiki page and a code review habit. The one engineer who enforced it moved teams. A custom rule is the standard written down in a form that does not leave with anybody.
Field noteFindings in shared modules are the ones with the widest blast radius and the slowest fix. The module is consumed by nine services. The fix is one line. The release of the module version is a nine-team coordination, and the finding stays open until somebody owns the module rather than a consumer of it.
Field noteThe Kubernetes manifest rules fire on privileged containers and host network access, and the finding is accepted every time because the workload is a monitoring agent that needs them. Without a scoped exclusion in the scanner configuration, the accepted case fires forever and trains the team to accept the next one.
Modules resolvable first. Provider rules second. The platform standard as a rule, then the gate.
IaC Security is delivered inside the Code Security Accelerator, four weeks, fixed scope. Where Cloud Security Posture Management is already running, the posture findings are the starting list: they say which misconfiguration classes the code has been letting through.
- List the infrastructure repositories and what they build. Which repository applies to which account, cluster or environment, and which team owns each. Repositories that describe nothing currently deployed are excluded with the reason recorded.
- Make the code scannable. Module sources the scanner can resolve, Helm dependencies present in the chart directory, lockfiles for provider versions committed. Checked before the first scan, so the first results are results.
- Enable the provider rules per repository. AWS rules on the AWS repositories, Azure on Azure, Kubernetes and Docker rules where manifests and Dockerfiles live. Nothing enabled for a provider the repository does not touch.
- Write the custom rules from the standard you have. The platform team's requirements, tags, encryption, regions, naming, encoded as rules. Accepted exceptions encoded alongside them, so the monitoring agent's privileged container stops firing.
- Run informational, reconcile, then gate. Pull request comments on for a fortnight. IaC findings compared with posture findings in the same accounts. Gates made blocking only for the severities the platform team agreed, and recorded.
- Hand over, in writing. Repository list and what each builds, rules in force per repository, and custom rules with the standard they encode. Gate severities, muted findings with reasons, the reconciliation against posture, and the open findings on the day we finished.
Access is admin on the Datadog organisation and the Datadog app on the source host with read access to the infrastructure repositories and permission to comment on pull requests. We do not apply your infrastructure code, and we do not need credentials for your cloud accounts to do this. Remediation pull requests are opened for your platform team to review.
A rule that encodes last year's standard enforces last year's standard
The platform team changes the encryption requirement. A new account is built from a new repository. A gate switched off for a migration stays off. Managed Observability is the monthly service that keeps the rules, the repositories and the gates matching the platform as it is now, and matching what the posture tool is seeing.
Every month, the two lists are reconciled. New IaC findings are read against new posture findings in the same accounts. A posture finding with no IaC finding behind it is a change made outside the code, and it is raised as such.
Coverage follows the platform. New infrastructure repositories are enabled with the rules for their provider. A repository that no longer builds anything is removed. Custom rules are re-read whenever the platform standard changes.
The gates stay what was agreed. A gate switched off for a release is found in the review and restored, or formally retired with a reason. The record of which gates were blocking, and when, is kept for the questionnaire.
The shared module gets an owner. A finding in a module consumed by many services is routed to the module's owner, not to each consumer, with the version bump drafted and the consumers listed.
We operate the stack. You own the product.
We are not a security company, and we do not write your platform standard for you. We are a managed runtime operator. We run the infrastructure scanning inside your Datadog and encode the standard you already hold. We reconcile what it finds against the cloud accounts we watch. We fix what sits in the runtime we operate, and route the rest to the platform team with the evidence attached. We operate and evidence the runtime controls that support your compliance obligations. The infrastructure code and the apply stay yours.
Datadog is our proof, not our headline. Datadog certified one managed provider globally. We are it. The Powered by Datadog accreditation means Datadog's own engineers reviewed how we instrument, alert, respond and report. We are also a Datadog Advanced Partner, ISO 27001 certified and Cyber Essentials Plus certified, with offices in Cardiff, London and Dublin.
Datadog IaC Security, answered plainly
Which infrastructure as code formats does Datadog IaC Security scan?
Terraform, CloudFormation, Kubernetes manifests, Dockerfiles and Docker Compose, Ansible playbooks and GitHub Actions workflows, with rules for AWS, Azure, Google Cloud and Alibaba Cloud resources. The rules are grouped by format and provider, so a Terraform repository for AWS gets a different applicable set from an Ansible repository for Azure. For Helm, each chart directory needs its dependent charts present for the scan to resolve what the template produces.
How is Datadog IaC Security billed?
IaC Security is part of Code Security, billed per committer, per month, on its own or in the Code Security bundle that includes it. Datadog counts a committer as an active Git author, identified by email address, who commits at least three times in the month. Datadog publishes the current meters and rates. We do not publish prices. We do decide, with you, which repositories are enabled, and a fork of a public module library stays out unless you apply code from it.
How does IaC Security relate to Cloud Security Posture Management?
They ask the same question at different times. IaC Security reads the Terraform or CloudFormation before it is applied and reports the public bucket in the pull request. Cloud Security Posture Management reads the cloud account after it is applied and reports the public bucket that exists. A posture finding with no IaC finding behind it means the resource was changed outside the code, or the code was never scanned. We run both and reconcile them, so a fix in the code can be matched to the finding in the account closing.
Can we add our own rules to Datadog IaC Security?
Yes. Custom rules enforce requirements that are yours rather than generic: a mandatory cost-centre tag, encryption with a customer-managed key, a region allow-list, a naming convention the platform team depends on. We write them from the standard you already have, where one exists, and run them informational until the platform team agrees the results. A custom rule is also where the organisation's accepted exceptions are encoded, so a finding does not fire on a resource that was approved to be different.
What does Critical Cloud do with IaC Security every month?
Managed Observability reviews new IaC findings against the posture findings in the same accounts, works the ones that would create a public or unencrypted resource with the owning team, confirms new infrastructure repositories are enabled, checks that the gates agreed are still in force, reviews custom rules against any changes to the platform standard, re-confirms muted findings, and reports what was found, fixed and routed. A finding that reached the cloud account because it was merged with a gate off is raised with the platform owner.
- Datadog products: every product, and how we implement and run each one
- Code Security: the group, and how findings reach the developer
- Cloud Security Posture Management: the same misconfigurations, found in the account after apply
- Code Security Accelerator: repositories, scanners, rules and gates, in four weeks
The standard enforced in the pull request. The posture finding that never happens.
Tell us which repositories build production and which posture findings keep coming back. We will show you which of them the code would have caught, and what it takes to catch the next one.