trivy/docs/guide/coverage/iac/index.md

Infrastructure as Code

Scanner

Trivy scans Infrastructure as Code (IaC) files for

• Misconfigurations
• Secrets

Supported configurations

Config type	File patterns
Kubernetes	*.yml, *.yaml, *.json
Docker	Dockerfile, Containerfile
Terraform	*.tf, *.tf.json, *.tfvars
Terraform Plan	tfplan, *.tfplan, *.json
CloudFormation	*.yml, *.yaml, *.json
Azure ARM Template	*.json
Helm	*.yml, *.yaml, *.tpl, *.tar.gz, etc.
YAML	*.yaml, *.yml
JSON	*.json
Ansible	*.yml, *.yaml, *.json, *.ini, without extension