> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plerion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# plerion iac

> Infrastructure as Code scanning for Terraform, CloudFormation, Kubernetes, and more.

With **plerion iac**, you can scan Infrastructure as Code (IaC) files for security findings and vulnerabilities. Supported formats include Terraform, CloudFormation, Bicep, ARM, Kubernetes, Helm, and Dockerfile.

***

## Synopsis

```bash theme={"system"}
plerion iac <subcommand> [options]
```

***

## Subcommands

### scan

Upload a zip file for IaC scanning.

```bash theme={"system"}
plerion iac scan --file <file.zip> --name <artifact-name>
```

<Note>
  Maximum upload size is 4.4 MB. Zip your IaC files before uploading.
</Note>

### list-scans

List previous IaC scans.

```bash theme={"system"}
plerion iac list-scans [options]
```

| Flag | Type | Description |
| - | - | - |
| `--ids` | string | Filter by scan IDs (comma-separated) |
| `--artifact-name` | string | Filter by artifact names (comma-separated) |
| `--status` | string | Filter by status: `SUCCESS`, `FAILURE` (comma-separated) |
| `--sort-by` | string | Sort by field (`id`, `createdAt`, `updatedAt`, `artifactName`, `status`) |
| `--sort-order` | string | `asc` or `desc` |
| `--per-page` | number | Results per page (default: 50, max: 1000) |
| `--all` | flag | Fetch all pages automatically |

### get-findings

Get security findings from a completed scan.

```bash theme={"system"}
plerion iac get-findings --scan-id <scan-id> [options]
```

| Flag | Type | Description |
| - | - | - |
| `--scan-id` | string | **(required)** Scan ID returned from `iac scan` |
| `--ids` | string | Filter by finding IDs (comma-separated) |
| `--status` | string | Filter by result: `PASSED`, `FAILED` (comma-separated) |
| `--severity` | string | Filter by severity: `CRITICAL`, `HIGH`, `MEDIUM`, `LOW` (comma-separated) |
| `--detection-id` | string | Filter by detection IDs (comma-separated) |
| `--type` | string | Filter by type (comma-separated, e.g. `terraform`, `kubernetes`) |
| `--file` | string | Filter by file paths (comma-separated) |
| `--sort-by` | string | Sort by field (`id`, `createdAt`, `updatedAt`, `artifactName`, `status`) |
| `--sort-order` | string | `asc` or `desc` |
| `--per-page` | number | Results per page (default: 50, max: 1000) |
| `--all` | flag | Fetch all pages automatically |

### get-vulnerabilities

Get vulnerabilities from a completed scan.

```bash theme={"system"}
plerion iac get-vulnerabilities --scan-id <scan-id> [options]
```

| Flag | Type | Description |
| - | - | - |
| `--scan-id` | string | **(required)** Scan ID returned from `iac scan` |
| `--ids` | string | Filter by vulnerability IDs (comma-separated) |
| `--severity` | string | Filter by severity: `CRITICAL`, `HIGH`, `MEDIUM`, `LOW` (comma-separated) |
| `--vulnerability-id` | string | Filter by CVE/vulnerability IDs (comma-separated) |
| `--severity-source` | string | Filter by severity source (comma-separated, e.g. `nvd`, `github`) |
| `--file` | string | Filter by file paths (comma-separated) |
| `--has-kev` | flag | Filter for CISA Known Exploited Vulnerabilities |
| `--has-exploit` | flag | Filter for vulnerabilities with known exploits |
| `--sort-by` | string | Sort by field (`id`, `vulnerabilityId`, `severityLevel`, `hasKev`, `hasExploit`, `file`, `createdAt`, `updatedAt`) |
| `--sort-order` | string | `asc` or `desc` |
| `--per-page` | number | Results per page (default: 50, max: 1000) |
| `--all` | flag | Fetch all pages automatically |

***

## Examples

```bash theme={"system"}
# Zip and scan a Terraform directory
zip -r infra.zip ./terraform/
plerion iac scan --file infra.zip --name infra.zip

# List all scans
plerion iac list-scans --output table

# List only successful scans
plerion iac list-scans --status SUCCESS

# Get all findings from a scan
plerion iac get-findings --scan-id scan-abc123 --all

# Get only failed findings
plerion iac get-findings --scan-id scan-abc123 --status FAILED

# Get critical and high severity findings
plerion iac get-findings --scan-id scan-abc123 --severity CRITICAL,HIGH

# Get vulnerabilities with known exploits
plerion iac get-vulnerabilities --scan-id scan-abc123 --has-exploit --output json

# Full workflow
zip -r infra.zip ./terraform/
plerion iac scan --file infra.zip --name infra.zip
# Note the scan ID from output, then:
plerion iac get-findings --scan-id <scan-id> --status FAILED --output table
plerion iac get-vulnerabilities --scan-id <scan-id> --severity CRITICAL,HIGH --all
```

***

## Output columns (list-scans)

| Column | Description |
| - | - |
| ID | Scan ID |
| ARTIFACT | Artifact name (uploaded zip filename) |
| STATUS | Scan status (e.g. `SUCCESS`, `FAILURE`) |
| TYPES | Detected IaC types (e.g. `terraform`, `kubernetes`) |
| FINDINGS | Total findings count |
| FAILED | Failed findings count |
| PASSED | Passed findings count |
| VULNS | Vulnerability count |
| TENANT ID | Tenant ID |
| ORG ID | Organization ID |
| CREATED AT | Scan creation timestamp |
| UPDATED AT | Scan update timestamp |

## Output columns (get-findings)

| Column | Description |
| - | - |
| ID | Finding ID |
| SCAN ID | Parent scan ID |
| DETECTION ID | Detection rule ID |
| DETECTION TITLE | Detection rule title |
| TYPE | Finding type |
| RESULT | `PASSED` or `FAILED` |
| SEVERITY | Severity level |
| FILE | Source file path |
| LINE RANGE | Affected line range (e.g. `10-25`) |
| RESOURCE | Resource identifier |
| DASHBOARD URL | Link to finding in the Plerion dashboard |
| TENANT ID | Tenant ID |
| ORG ID | Organization ID |
| CREATED AT | Record creation timestamp |
| UPDATED AT | Record update timestamp |

## Output columns (get-vulnerabilities)

| Column | Description |
| - | - |
| ID | Vulnerability record ID |
| CVE / VULN ID | CVE or vulnerability identifier |
| TITLE | Vulnerability title |
| SEVERITY | Severity level |
| SEVERITY VALUE | Numeric severity score |
| DESCRIPTION | Vulnerability description |
| FILE | Source file containing the vulnerable dependency |
| KEV | CISA Known Exploited Vulnerability |
| EXPLOIT | Has known exploit |
| EPSS | EPSS score as a percentage, such as `94.3%`, `<0.1%` or `>99.9%`. Blank when the vulnerability has no score. Text output keeps the raw 0 to 1 value |
| EPSS DATE | Date FIRST published the EPSS score (`YYYY-MM-DD`). Blank when there is no score |
| PACKAGES | Affected package name(s) |
| PRIMARY URL | Link to CVE or advisory |
| PUBLISHED | Publication date |
| TENANT ID | Tenant ID |
| ORG ID | Organization ID |
| CREATED AT | Record creation timestamp |
| UPDATED AT | Record update timestamp |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.