The research involved scanning the TerraGoat Terraform repository, which is intentionally vulnerable, using three distinct IaC security scanners: Checkov (by Bridgecrew), Trivy (by Aqua Security), and pq-audit (a post-quantum cryptography scanner). Checkov detected 56 known vulnerabilities designed into TerraGoat. Trivy found 243 issues, 77% of which were not documented by Checkov, reflecting a broader security scope including AWS CIS benchmarks, Kubernetes pod security, container hardening, and cloud network exposure. pq-audit identified 4 cryptographic vulnerabilities with no overlap with the other scanners, highlighting risks from both current classical attacks and future quantum computing threats. The findings were confirmed as true positives with zero false positives. The study demonstrates that different scanners encode different threat timelines and security models, and using multiple tools provides a more comprehensive security assessment for Terraform IaC pipelines.

The impact is that relying solely on one IaC scanner, such as Checkov, can result in missing a substantial portion (up to 77%) of security findings relevant to cloud infrastructure misconfigurations and cryptographic risks. This gap could leave infrastructure exposed to classical attacks (e.g., weak TLS versions, overly permissive ACLs) and future quantum threats (e.g., RSA keys vulnerable to quantum decryption). The validated findings indicate real security weaknesses in the Terraform configurations that could be exploited if not addressed. The research underscores the importance of multi-tool scanning to cover diverse threat models and timelines.

This is a research and benchmarking study rather than a vulnerability with a direct patch. There is no single patch or fix applicable. Instead, the mitigation recommendation is to incorporate multiple IaC security scanners with complementary threat models into Terraform security pipelines to achieve comprehensive coverage. Specifically, use Checkov for known benchmark vulnerabilities, Trivy for broader cloud and container misconfigurations, and pq-audit for cryptographic posture assessment including quantum resilience. This layered scanning approach reduces the risk of missing critical security issues. No vendor advisory or official patch applies to this research.