# Share a Terrascan Report — Policy Violations Somebody Will Read

Canonical: https://commareports.com/share-terrascan-report
Published: 2026-09-15

> Terrascan scans IaC against policy and writes SARIF, JUnit or JSON. Render it, publish to Comma, and the violations reach the module owners as a link with threads.

# Share a Terrascan report

Policy-as-code has a delivery problem. The policies live with the platform
team, the violations live in the pipeline of whichever service tripped them,
and the service team reads `FAILED: AWS.S3Bucket.DS.High.1043` with no
context about why anyone cares.

A rendered report closes that gap, because a rendered report can carry a
comment.

## SARIF → HTML

```bash
terrascan scan -i terraform -d . -o sarif > terrascan.sarif || true

pip install sarif-tools
sarif html terrascan.sarif --output terrascan.html
```

Swap `-i terraform` for `k8s`, `helm`, `kustomize`, `docker` or `cft`
depending on the stack. Scan each type into its own report rather than
concatenating — the audiences are different.

## Or JUnit

```bash
terrascan scan -i terraform -d . -o junit-xml > terrascan.xml || true
junit2html terrascan.xml terrascan.html
```

## Publish it

Drag `terrascan.html` into [the app](https://commareports.com/), or from CI:

```bash
curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html terrascan.html \
        --arg title "Terrascan — $GITHUB_REF_NAME" '{title: $title, html: $html}')"
```

Keep a separate unmuted `terrascan scan --severity high` step if high-severity
findings should block.

## Exceptions belong next to the finding

The realistic outcome of any policy scan is that some percentage of the
findings are accepted risk. Today that acceptance lives in a `skip_rules`
annotation, a Jira ticket and somebody's memory — three places, none of which
is the report.

- **Anchored threads** on the violation: "public read is intentional, this is
  the CDN origin bucket, approved in SEC-412." Recorded where the next person
  to read the finding will see it. See [commenting on HTML](/comment-on-html).
- **Revisions** across scheduled scans, so an exception that was supposed to
  be temporary is visibly not.
- **Access per report** — team-scoped by default. See the
  [sharing model](/docs/sharing).

## Limits

- **Entry HTML: 5 MB.** Assets: 25 MB per file, 250 MB and 500 files total.
- **60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision
history.

**[Publish a security report →](https://commareports.com/)**

### Related

- [Share a tfsec report](/share-tfsec-report) · [Share a Checkov report](/share-checkov-report)
- [Share a TFLint report](/share-tflint-report) · [Share a KICS report](/share-kics-report)
- [Share a Kubescape report](/share-kubescape-report) · [Share a SARIF report](/share-sarif-report)