infraguard

module

v0.10.1 Latest Latest Go to latest Published: Jul 3, 2026 License: Apache-2.0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/aliyun/infraguard

Links

Open Source Insights

README ¶

InfraGuard

Policy Defined. Infrastructure Secured.

Infrastructure as Code (IaC) compliance pre-check CLI for Alibaba Cloud ROS and Terraform templates. Evaluate your ROS YAML/JSON templates and Terraform .tf configurations against security and compliance policies before deployment.

InfraGuard embraces Policy as Code - treating compliance policies as versioned, testable, and reusable code artifacts.

Features

Pre-deployment Validation - Catch compliance issues before they reach production
Dual Scan Modes - Static analysis or cloud-based preview validation
ROS and Terraform Support - Scan ROS YAML/JSON templates and Terraform .tf projects
Built-in Rules - Comprehensive coverage for Aliyun services
Compliance Packs - MLPS, ISO 27001, PCI-DSS, SOC 2, and more
Editor Integration - VS Code extension with auto-completion, real-time diagnostics, and hover documentation for ROS templates
Multilingual Support - Available in 7 languages (English, Chinese, Spanish, French, German, Japanese, Portuguese)
Multiple Output Formats - Table, JSON, and interactive HTML reports
Extensible - Write custom policies in Rego (Open Policy Agent)
Fast - Built in Go for speed and efficiency

Quick Start

Installation

brew tap aliyun/infraguard https://github.com/aliyun/infraguard
brew install infraguard

Or install with Go:

go install github.com/aliyun/infraguard/cmd/infraguard@latest

Or download pre-built binaries from GitHub Releases.

Basic Usage

# Scan with a compliance pack
infraguard scan template.yaml -p pack:aliyun:quick-start-compliance-pack

# Scan a Terraform project or .tf file
infraguard scan ./terraform -p pack:aliyun:quick-start-compliance-pack
infraguard scan main.tf -p rule:aliyun:ecs-instance-no-public-ip

# Scan with a specific rule
infraguard scan template.yaml -p rule:aliyun:ecs-instance-no-public-ip

# Scan with wildcard pattern (all rules)
infraguard scan template.yaml -p "rule:*"

# Scan with wildcard pattern (all ECS rules)
infraguard scan template.yaml -p "rule:aliyun:ecs-*"

# Generate HTML report
infraguard scan template.yaml -p pack:aliyun:mlps-level-3-pre-check-compliance-pack --format html -o report.html

Documentation

For detailed documentation, please visit our Documentation Site

Getting Started - Installation and quick start guide
User Guide - Learn how to scan templates and manage policies
Policy Reference - Browse all available rules and compliance packs
Development Guide - Write custom rules and packs
CLI Reference - Command-line interface documentation
FAQ - Frequently asked questions

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
cmd
infraguard command
infraguard-wasm command Command infraguard-wasm exposes client-side scanning to the browser for the documentation playground.	Command infraguard-wasm exposes client-side scanning to the browser for the documentation playground.
infraguard/cmd
policy-dump command Command policy-dump exports rule modules and metadata as JSON for the wasm playground.	Command policy-dump exports rule modules and metadata as JSON for the wasm playground.
policy-gen command
pkg
auth Package auth provides cloud credential management.	Package auth provides cloud credential management.
config Package config provides configuration management for InfraGuard CLI.	Package config provides configuration management for InfraGuard CLI.
engine Package engine provides OPA/Rego policy evaluation.	Package engine provides OPA/Rego policy evaluation.
i18n Package i18n provides internationalization support.	Package i18n provides internationalization support.
loader Package loader handles generic template input parsing.	Package loader handles generic template input parsing.
lsp Package lsp implements a Language Server Protocol server for ROS templates.	Package lsp implements a Language Server Protocol server for ROS templates.
lsp/document Package document manages text document state for the LSP server.	Package document manages text document state for the LSP server.
lsp/protocol Package protocol defines LSP protocol types for JSON-RPC communication.	Package protocol defines LSP protocol types for JSON-RPC communication.
lsp/schema Package schema provides ROS resource type schema management.	Package schema provides ROS resource type schema management.
lsp/template Package template provides ROS template parsing and analysis.	Package template provides ROS template parsing and analysis.
mapper Package mapper provides source code location mapping.	Package mapper provides source code location mapping.
models Package models defines core data structures for InfraGuard.	Package models defines core data structures for InfraGuard.
policy Package policy manages policy library download and discovery.	Package policy manages policy library download and discovery.
policytest Package policytest runs convention-based behavior tests for policy rules.	Package policytest runs convention-based behavior tests for policy rules.
providers/ros Package ros implements the ROS (Resource Orchestration Service) provider for InfraGuard.	Package ros implements the ROS (Resource Orchestration Service) provider for InfraGuard.
providers/terraform
reporter Package reporter provides output formatting and rendering.	Package reporter provides output formatting and rendering.
resolver
resolver/funcs
server Package server provides the local web server for InfraGuard (`infraguard server`).	Package server provides the local web server for InfraGuard (`infraguard server`).
updater
waiver Package waiver implements rule waivers (suppressions) for InfraGuard scans.	Package waiver implements rule waivers (suppressions) for InfraGuard scans.
scripts Script to fetch ROS resource type schema from Alibaba Cloud ROS API.	Script to fetch ROS resource type schema from Alibaba Cloud ROS API.