# trivy config: Scan IaC and Dockerfiles

> trivy config scans Terraform, Kubernetes, Dockerfiles, and Helm for misconfigurations. Reference for the misconfig scanner, policies, and CI errors.

Source: https://latchkey.dev/learn/command-reference/trivy-config-scan  
Updated: 2026-06-30

trivy config scans infrastructure-as-code (Terraform, Kubernetes, Dockerfile, Helm) for security misconfigurations.

Misconfigured infrastructure is as risky as a vulnerable package. trivy config runs the built-in misconfiguration checks against IaC files so insecure defaults fail the build.

## What it does

trivy config evaluates IaC files against Trivy built-in policies (sourced from the misconfiguration checks). It understands Terraform, CloudFormation, Kubernetes manifests, Dockerfiles, Helm charts, and more, reporting each failed check with a severity and remediation hint.

## Common usage

```Terminal
trivy config .
trivy config --severity HIGH,CRITICAL ./deploy
# scan a single Dockerfile
trivy config Dockerfile
```

## Options

| Flag | What it does |
| --- | --- |
| --severity <list> | Severities to report |
| --exit-code <n> | Exit code when misconfigurations are found |
| --config-check <dir> | Load additional custom Rego policy directories |
| --skip-dirs <dir> | Exclude paths from the scan |
| --format <fmt> | table, json, sarif |
| --include-non-failures | Also show checks that passed |

## In CI

Gate IaC changes with trivy config --exit-code 1 --severity HIGH,CRITICAL on the directory holding your manifests. Pair it with trivy fs in the same job to cover both dependencies and infrastructure in one pass.

## Common errors in CI

"no results" on a directory you expected findings in usually means trivy did not recognize the file type; confirm the extension and that the files are valid (a Terraform parse error silently skips the file). "failed to load custom policies" with --config-check means the Rego path is wrong or the policy has a syntax error.

## FAQ

### trivy config: Scan IaC and Dockerfiles?

Misconfigured infrastructure is as risky as a vulnerable package. trivy config runs the built-in misconfiguration checks against IaC files so insecure defaults fail the build.

### What it does?

trivy config evaluates IaC files against Trivy built-in policies (sourced from the misconfiguration checks). It understands Terraform, CloudFormation, Kubernetes manifests, Dockerfiles, Helm charts, and more, reporting each failed check with a severity and remediation hint.

### In CI?

Gate IaC changes with trivy config --exit-code 1 --severity HIGH,CRITICAL on the directory holding your manifests. Pair it with trivy fs in the same job to cover both dependencies and infrastructure in one pass.

### Common errors in CI?

"no results" on a directory you expected findings in usually means trivy did not recognize the file type; confirm the extension and that the files are valid (a Terraform parse error silently skips the file). "failed to load custom policies" with --config-check means the Rego path is wrong or the policy has a syntax error.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt