---
title: Code Locations
description: >-
  Connect Cloud Security misconfiguration findings to the infrastructure as code
  (IaC) that defines the affected resource so you can remediate at the source.
breadcrumbs: Docs > Datadog Security > Cloud Security > Code Locations
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Code Locations
Available for:
{% icon name="icon-cloud-security-management" /%}
 Cloud Security Misconfigurations 
## Overview{% #overview %}

A Cloud Security misconfiguration finding starts from a live cloud resource, such as an S3 bucket. The next question is usually where that bucket is defined in your codebase, so you can fix it at the source. Code location answers that by connecting the finding to the infrastructure as code (IaC) that created the resource, so the fix holds instead of being reverted the next time your IaC is applied.

Code location applies only to resources defined in IaC. A resource created at runtime (through the CLI, the cloud console, or an SDK) has no code to link to.

### Supported IaC formats{% #supported-iac-formats %}

- Terraform

### What a code location shows{% #what-a-code-location-shows %}

When Datadog resolves a code location for a finding, the finding side panel shows the repository, file, and line that define the resource, a link to those lines in your source control provider, and the code owners responsible for the file.

{% image
   source="https://docs.dd-static.net/images/security/csm/code_location_misconfiguration.22921442a5630dc23d2258b1c062eb8d.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/csm/code_location_misconfiguration.22921442a5630dc23d2258b1c062eb8d.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="A misconfiguration finding side panel showing the repository, file, line, and code owners that define the resource" /%}

## Prerequisites{% #prerequisites %}

To see code locations on your misconfiguration findings, you need:

- [Cloud Security Misconfigurations](https://docs.datadoghq.com/security/cloud_security_management/misconfigurations.md) enabled for the cloud accounts you want to scan, so that findings are generated.
- [Source Code Integration](https://docs.datadoghq.com/integrations/guide/source-code-integration.md) connected to the repositories that contain your IaC. Datadog indexes supported IaC files in your connected repositories to determine where each resource is defined.

After both are configured, Datadog resolves code locations for supported resources automatically. Coverage increases as you connect more of the repositories that manage your cloud infrastructure.

## Improve code location coverage{% #improve-code-location-coverage %}

Datadog resolves code locations most reliably when it can read the state your IaC tool maintains. States map each resource in your cloud account to the block of code that declares it, which gives Datadog a definitive match. Without it, Datadog infers the match from resource names and attributes, and resolves code locations for fewer findings.

### Terraform state files{% #terraform-state-files %}

If you store Terraform states in Amazon S3, enable [Agentless Scanning](https://docs.datadoghq.com/security/cloud_security_management/setup/agentless_scanning.md). Agentless Scanning already has the read access needed to locate state files in your S3 buckets, so no additional configuration is required. Datadog reads only the fields needed to resolve code locations from each state file.

## View the code location for a finding{% #view-the-code-location-for-a-finding %}

1. Navigate to the [Misconfigurations findings](https://app.datadoghq.com/security/csm/misconfigurations-and-attack-paths) page.
1. Select a finding to open its side panel.
1. In the **Where (IAC)** section, review the repository, file, and line where the resource is defined.
1. Click the file to open the exact lines in your source control provider, or review the listed code owners to identify the team that owns the file.

## Filter findings by code location{% #filter-findings-by-code-location %}

To focus on findings that Datadog can trace to source code, search the Misconfigurations findings page for `@code_location.filename:*`. This returns every misconfiguration for which a code location is resolved—effectively a view of what you can remediate in code.

You can narrow the results further. For example:

- `@code_location.filename:*.tf` returns findings whose code locations are in Terraform files.
- `@code_location.filename:*network*` returns findings defined in your network modules.

## Remediate in source code{% #remediate-in-source-code %}

After you locate the code that defines a misconfigured resource, you can remediate it in several ways:

- **Remediate with AI**: Click **Remediate with AI** on the finding to hand off the fix to [Bits Code](https://docs.datadoghq.com/bits_ai/bits_code.md), or to copy a fix prompt into the coding agent you already use. See [Remediate with AI](https://docs.datadoghq.com/security/cloud_security_management/review_remediate/remediate_with_ai.md).
- **Route to the right team**: Use the code owners shown on the finding to assign the fix to the team that owns the file, or [create a ticket](https://docs.datadoghq.com/security/ticketing_integrations.md) in your ticketing tool.
- **Automate remediation**: Use [Workflow Automation](https://docs.datadoghq.com/security/cloud_security_management/review_remediate/workflows.md) to build automated remediation workflows, with or without human approval.

If a misconfiguration doesn't apply to your environment or is an accepted risk, you can [mute it](https://docs.datadoghq.com/security/cloud_security_management/review_remediate/mute_issues.md) instead.

## Further reading{% #further-reading %}

Additional helpful documentation, links, and articles:

- [Cloud Security Misconfigurations](https://docs.datadoghq.com/security/cloud_security_management/misconfigurations.md)
- [Set up Source Code Integration](https://docs.datadoghq.com/integrations/guide/source-code-integration.md)
- [Automate remediation with Workflow Automation](https://docs.datadoghq.com/security/cloud_security_management/review_remediate/workflows.md)