--- title: Set up IaC Security description: Datadog, the leading service for cloud-scale monitoring. breadcrumbs: >- Docs > Datadog Security > Code Security > Infrastructure as Code (IaC) Security > Set up IaC Security --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # Set up IaC Security {% callout %} # Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com {% alert level="danger" %} This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}). {% /alert %} {% /callout %} Use the following instructions to enable Infrastructure as Code (IaC) Security for Code Security. IaC Security supports multiple IaC configurations stored in GitHub, GitLab, or Azure DevOps repositories. {% tab title="GitHub" %} ### Install the GitHub integration{% #install-the-github-integration %} To connect your GitHub repositories and enable PR comments, see the setup instructions in [Pull Request Comments](https://docs.datadoghq.com/security/code_security/dev_tool_int/pull_request_comments.md?tab=github#set-up-pull-request-comments). ### Enable IaC Security for your repositories{% #enable-iac-security-for-your-repositories %} After setting up the GitHub integration, enable IaC Security for your repositories. 1. On the [Code Security Setup page](https://app.datadoghq.com/security/configuration/code-security/setup), expand the Activate scanning for your repositories section. 1. Under Select your source code management provider, select GitHub. 1. Under Select where your scans should run, select Datadog. 1. Under Connect your GitHub repositories, do one of the following: - To connect a new GitHub account, click Add GitHub Account. - To enable IaC Security for an existing account, click Select repositories, or Edit if Code Security is already enabled. 1. To enable IaC Security, do one of the following: - To enable it for all repositories, toggle Enable Infrastructure as Code Scanning (IaC) to the ON position. - To enable it for a single repository, toggle the IaC switch to ON for that repository. {% /tab %} {% tab title="GitLab" %} ### Install the GitLab integration{% #install-the-gitlab-integration %} To connect your GitLab repositories and enable PR comments, see the setup instructions in [GitLab Source Code](https://docs.datadoghq.com/integrations/gitlab-source-code.md#setup). ### Enable IaC Security for your repositories{% #enable-iac-security-for-your-repositories %} After setting up the GitLab integration, enable IaC Security for your repositories. 1. On the [Code Security Setup page](https://app.datadoghq.com/security/configuration/code-security/setup), expand the Activate scanning for your repositories section. 1. Under Select your source code management provider, select GitLab. 1. Under Select where your scans should run, select Datadog. 1. Under Connect your GitLab repositories, do one of the following: - To connect a new GitLab instance, click Connect GitLab Instance. - To enable IaC Security for an existing account, click Select repositories, or Edit if Code Security is already enabled. 1. To enable IaC Security, do one of the following: - To enable it for all repositories, toggle Enable Infrastructure as Code Scanning (IaC) to the ON position. - To enable it for a single repository, toggle the IaC switch to ON for that repository. {% /tab %} {% tab title="Azure DevOps" %} ### Install the Azure DevOps integration{% #install-the-azure-devops-integration %} To connect your Azure DevOps repositories and enable PR comments, see the setup instructions in [Azure DevOps Source Code](https://docs.datadoghq.com/integrations/azure-devops-source-code.md#source-code-functionality). ### Enable IaC Security for your repositories{% #enable-iac-security-for-your-repositories %} After setting up the Azure DevOps integration, enable IaC Security for your repositories. 1. On the [Code Security Setup page](https://app.datadoghq.com/security/configuration/code-security/setup), expand the Activate scanning for your repositories section. 1. Under Select your source code management provider, select Azure DevOps. 1. Under Select where your scans should run, select Datadog. 1. Under Connect your Azure DevOps repositories, do one of the following: - To connect a new Azure DevOps organization, click Connect Microsoft Entra App. - To enable IaC Security for an existing account, click Select repositories, or Edit if Code Security is already enabled. 1. To enable IaC Security, do one of the following: - To enable it for all repositories, toggle Enable Infrastructure as Code Scanning (IaC) to the ON position. - To enable it for a single repository, toggle the IaC switch to ON for that repository. {% /tab %} ## Set up IaC with a generic CI provider{% #set-up-iac-with-a-generic-ci-provider %} ### Overview{% #overview %} If you don't use GitHub Actions, GitLab CI/CD, or Azure DevOps, you can run the [Datadog IaC Scanner](https://github.com/DataDog/datadog-iac-scanner) directly in your CI pipeline. Upload IaC scan results to Datadog using the [`datadog-ci` CLI](https://github.com/DataDog/datadog-ci?tab=readme-ov-file#sarif). **If you are running IaC Security on a non-GitHub repository**, run the first scan on your default branch. If your default branch uses a name other than `master`, `main`, `default`, `stable`, `source`, `prod`, or `develop`, upload a first scan for your repository. Then, manually override the default branch in [Repository Settings](https://app.datadoghq.com/source-code/repositories) so that future scans from non-default branches are uploaded and correctly processed. ### Prerequisites{% #prerequisites %} - Node.js 20 or later and npm - `curl` - `tar` - Permission to install the scanner in `/usr/local/bin` Configure the following environment variables: | Name | Description | Required | Default | | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | --------------- | | `DD_API_KEY` | Your Datadog API key. Create this key in your [Datadog organization](https://docs.datadoghq.com/account_management/api-app-keys.md) and store the key as a secret. | Yes | | `DD_APP_KEY` | Your application key. Create this key in your [Datadog organization](https://docs.datadoghq.com/account_management/api-app-keys.md) and include the `code_analysis_read` scope. Store the key as a secret. | Yes | | `DD_SITE` | The [Datadog site](https://docs.datadoghq.com/getting_started/site.md) to send information to. Your Datadog site is `datadoghq.com`. | No | `datadoghq.com` | Add the following to your CI pipeline: ```bash # Set the Datadog site to send information to export DD_SITE="datadoghq.com" # Install dependencies npm install -g @datadog/datadog-ci # Download the latest Datadog IaC Scanner (x86_64/amd64 Linux; see GitHub Releases for arm64 and other platforms) export IAC_SCANNER_URL="https://github.com/DataDog/datadog-iac-scanner/releases/latest/download/datadog-iac-scanner_linux_amd64.tar.gz" curl -L "${IAC_SCANNER_URL}" -o /tmp/datadog-iac-scanner.tar.gz tar xfz /tmp/datadog-iac-scanner.tar.gz -C /tmp mv /tmp/datadog-iac-scanner /usr/local/bin/datadog-iac-scanner # Run the Datadog IaC scanner exit_code=0 /usr/local/bin/datadog-iac-scanner scan -p . -o /tmp || exit_code=$? if [ $exit_code -lt 20 -o $exit_code -gt 60 ]; then echo "IaC scan failed" ; exit $exit_code ; fi # Upload results datadog-ci sarif upload /tmp/datadog-iac-scanner-result.sarif ``` {% alert level="info" %} This example uses the x86_64 (amd64) Linux version of the Datadog IaC Scanner. The scanner also supports arm64 Linux, as well as macOS and Windows. If you're using a different OS or architecture, select the appropriate release from the [GitHub Releases](https://github.com/DataDog/datadog-iac-scanner/releases) page and update the `IAC_SCANNER_URL` value. {% /alert %} ## Upload third-party static analysis results to IaC Security{% #upload-third-party-static-analysis-results-to-iac-security %} {% alert level="info" %} You can import SARIF results from third-party Infrastructure-as-Code (IaC) scanners, including Checkov, into IaC Security. See [Upload third-party static analysis results](https://docs.datadoghq.com/security/code_security/static_analysis/setup.md?tab=github#upload-third-party-static-analysis-results-to-datadog) for SARIF-compliant tools supported for SAST. Node.js version 14 or later is required. {% /alert %} To upload a SARIF report: 1. Ensure the [`DD_API_KEY` and `DD_APP_KEY` variables are defined](https://docs.datadoghq.com/account_management/api-app-keys.md). 1. Optionally, set a [`DD_SITE` variable](https://docs.datadoghq.com/getting_started/site.md) (this defaults to `datadoghq.com`). 1. Install the `datadog-ci` utility (version 2.0 or later): ```bash npm install -g @datadog/datadog-ci ``` 1. Run the third-party IaC scanning tool (e.g., Checkov, Trivy, KICS) on your code and output the results in the SARIF v2.1.0 format. 1. Upload the results to Datadog: ```bash datadog-ci sarif upload $OUTPUT_LOCATION ``` - Upload Options - `--tags:` Add custom tags (format: `key:value`) - `--max-concurrency:` Set concurrent uploads (default: 20) - `--dry-run:` Validate without uploading ### Required SARIF Attributes{% #required-sarif-attributes %} To ensure proper ingestion and display in Datadog IaC Scanning for third-party scanners (excluding Checkov), your SARIF file MUST include the following attributes to be recognized as an IaC security finding: 1. `Runs[...].tool.driver.name: Datadog IaC Scanning` 1. `Runs[...].tool.driver.version: "code_update"` or `"full_scan"` - `"full_scan"` for complete repository scans - `"code_update"` for pull request / incremental scans 1. `Runs[...].tool.driver.rules[...].properties.tags:` - `["DATADOG_RULE_TYPE:IAC_SCANNING"]` - `["DATADOG_SCANNED_FILE_COUNT: "]`, where `"number"` specifies the number of scanned files 1. `Runs[...].results[...].locations[...].physicalLocation:` - `artifactLocation.uri`: Relative path to file from repository root - `region.startLine`: Starting line number - `region.endLine`: Ending line number - `region.startColumn`: Starting column number - `region.endColumn`: Ending column number {% alert level="info" %} Suppressions silently drop violations. If `results[ ].suppressions` exists, the violation is completely ignored. {% /alert %} ## Further reading{% #further-reading %} Additional helpful documentation, links, and articles: - [Code Security](https://docs.datadoghq.com/security/code_security.md) - [IaC Security](https://docs.datadoghq.com/security/code_security/iac_security.md) - [Configure IaC Security](https://docs.datadoghq.com/security/code_security/iac_security/configuration.md) - [IaC Security Rules](https://docs.datadoghq.com/security/code_security/iac_security/iac_rules.md)