Cloud
Trivy
Scanner for container images, filesystems, IaC, and cloud misconfig in authorized build and landing-zone reviews.
What it is
Trivy covers CVE and misconfig across images, Terraform/CloudFormation, Kubernetes, and filesystems. On a cloud job it is the workload/IaC companion to Prowler. On a web job it is useful when the client gives you a container or a repo snapshot in scope.
Reach for it when
Cloud or workload reviews when images, IaC, or cluster configs are in scope and you need CVE plus misconfig in one pass.
Watch-outs
Scanning a private registry requires credentials — use the engagement role, not a developer's laptop login. Do not pull production images that contain ePHI locally if a digest-only or CI artifact will do. Triage CVEs; unfixed base-image noise is not a critical finding by itself.
Typical invocation
trivy config --severity HIGH,CRITICAL iac/landing-zone/
Authorized assessments only. Stay inside the rules of engagement.
Pin to a kit
Open an engagement first.
Related
- Prowler
Cloud security configuration scanner for AWS, Azure, and GCP against CIS and similar benchmarks.
- nuclei
Template-based vulnerability scanner for known issues on in-scope web, API, and network services.
- ScoutSuite
Multi-cloud audit tool that collects configuration via APIs and highlights risky settings.