3.5Combining Tools in a CI Pipeline

The strongest approach uses multiple tools, each catching different classes of issues:

# .github/workflows/iac-policy.yml
name: IaC Policy Checks
on:
  pull_request:
    paths:
      - 'terraform/**'
      - 'k8s/**'

jobs:
  policy-checks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: tfsec (fast, Terraform-specific)
        uses: aquasecurity/tfsec-action@v1.0.0
        with:
          working_directory: ./terraform/
          soft_fail: false

      - name: Checkov (broad coverage, multi-framework)
        uses: bridgecrewio/checkov-action@master
        with:
          directory: .
          framework: terraform,kubernetes,dockerfile
          output_format: cli,json
          output_file_path: console,checkov-results.json

      - name: OPA/Conftest (custom organizational policies)
        run: |
          terraform -chdir=terraform plan -out=tfplan
          terraform -chdir=terraform show -json tfplan > tfplan.json
          conftest test tfplan.json --policy policy/ --output json > opa-results.json

      - name: Trivy config scan (Dockerfiles + K8s)
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'config'
          scan-ref: '.'
          severity: 'HIGH,CRITICAL'

Choosing Your Combination

Team Profile	Recommended Stack	Rationale
Small startup, Terraform only	tfsec + Checkov	Fast setup, broad coverage, no custom policies needed
Enterprise, multi-cloud	Checkov + OPA/Conftest	Checkov for broad checks, OPA for custom compliance
Security-focused	tfsec + OPA + Snyk IaC	Defense in depth, multiple scanning engines
Kubernetes-heavy	Checkov + Polaris + OPA	K8s-specific + custom policies

The key principle: static policy checks should run in under 60 seconds and block merges for critical violations. They are your most cost-effective quality gate.