Terrascan Integration Guide

Integrate Terrascan with Vulnetix. Scan Terraform, CloudFormation, Kubernetes, Helm, and Dockerfiles.

Install & scan

$ # Download from https://github.com/tenable/terrascan/releases
$ terrascan scan -d . -i terraform -o sarif

Run Terrascan in CI

Scan on every push and upload the report as a workflow artifact:

- name: Install Terrascan
  run: |
    curl -L $(curl -s https://api.github.com/repos/tenable/terrascan/releases/latest | grep -o 'https://.*Linux_x86_64.tar.gz') | tar xz terrascan
    sudo mv terrascan /usr/local/bin/
- name: Run Terrascan
  run: terrascan scan -d . -i terraform -o sarif > terrascan.sarif
- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: terrascan
    path: terrascan.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Terrascan's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Terrascan. Keep running it. Vulnetix sits on top of Terrascan (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

Terrascan is strongest at its core category and also carries features in Container & Image Scanning, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What Terrascan does well

• 500+ Rego/OPA policies mapped to real compliance frameworks (CIS Benchmarks, NIST, HIPAA, PCI-DSS and SOC2) making it strong for audit-driven IaC gating
• Kubernetes admission-controller mode enforces policy at deploy time, not just in CI, which is rare among IaC scanners
• Full Rego policy engine (from Accurics/Tenable heritage) for writing custom organisational policies
• Broad IaC input support: Terraform, CloudFormation, Kubernetes, Helm, Kustomize and Dockerfile, with SARIF/JSON/JUnit output

Where Vulnetix adds to it: Terrascan was archived read-only by Tenable on 20 Nov 2025, so it no longer picks up new policies or provider changes. Vulnetix ingests its SARIF for teams still running it, dedupes into the one queue, and provides the actively-maintained IaC engine plus exploit-intel, VEX, EOL and SSVC layers on top. Better together while it lives; Vulnetix is the forward path.

No migration, no rip-and-replace. Terrascan keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Terrascan results in Vulnetix

Upload Terrascan SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Terrascan documentation ↗  ·  Source repository ↗

Wire Terrascan into your CI/CD pipeline →