Trivy IaC Integration Guide

Integrate Trivy IaC scanning with Vulnetix. Use trivy config to detect misconfigurations across Terraform, CloudFormation, Kubernetes manifests, Helm charts, ARM, and Dockerfiles.

Install & scan

$ # Homebrew (macOS/Linux)
brew install trivy

# Install script (Linux)
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin

# Debian/Ubuntu
sudo apt-get install wget gnupg
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null
echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb generic main" | sudo tee /etc/apt/sources.list.d/trivy.list
sudo apt-get update && sudo apt-get install trivy
$ trivy config .   --format sarif   --output trivy-iac.sarif

Run Trivy IaC in CI

Scan on every push and upload the report as a workflow artifact:

- name: Trivy IaC scan
  uses: aquasecurity/trivy-action@0.33.1
  with:
    scan-type: 'config'
    scan-ref: '.'
    format: 'sarif'
    output: 'trivy-iac.sarif'
    severity: 'CRITICAL,HIGH,MEDIUM'

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: trivy-iac
    path: trivy-iac.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Trivy IaC's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Trivy IaC. Keep running it. Vulnetix sits on top of Trivy IaC (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

Trivy IaC is strongest at its core category and also carries features in SCA, Secret Scanning, SBOM Generation, Container & Image Scanning, License Compliance, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What Trivy IaC does well

• All-in-one single Go binary: one tool covers IaC misconfig, dependency vulnerabilities, secrets, SBOM and license scanning via --scanners flags
• Broad IaC format support with auto-detection: Terraform, CloudFormation, Kubernetes, Helm, Dockerfile and Azure ARM
• Hundreds of built-in checks powered by OPA/Rego, extensible with custom Rego policies
• Fast, open-source (Aqua Security), widely adopted in CI and Kubernetes admission workflows

Where Vulnetix adds to it: Vulnetix ingests Trivy's misconfig, SCA, secret, SBOM and license output and deduplicates it against other scanners into one prioritised ASPM queue, adding EPSS/KEV/ESS exploit-intel, reachability, SSVC, immutable versioned VEX, EOL policy and Safe Harbour autofix. Better together: Trivy remains the multi-purpose scanning engine; Vulnetix is the correlation, prioritisation and remediation layer above it.

No migration, no rip-and-replace. Trivy IaC keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Trivy IaC results in Vulnetix

Upload Trivy IaC SARIF, JSON, CycloneDX output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Trivy IaC documentation ↗  ·  Source repository ↗

Wire Trivy IaC into your CI/CD pipeline →