What output formats does Terrascan support?

`-o` accepts human, json, yaml, xml, junit-xml, sarif and github-sarif. SARIF renders best to HTML with `sarif-tools`; junit-xml works with any JUnit converter.

Does it scan more than Terraform?

Yes — Terraform, Kubernetes manifests, Helm charts, Kustomize, Dockerfiles and CloudFormation, selected with `-i`. One report per stack type is usually clearer than one combined page.

How is it different from tfsec or Checkov?

Overlapping coverage, different policy engines and different default rule sets. Teams that run more than one usually publish them as separate reports and compare the deltas rather than trying to merge them.

Should a policy violation fail the build?

For high-severity rules on production stacks, usually yes — as a separate unmuted step. The reporting step should stay muted with `|| true` so medium and low findings still publish.

Who should see the report?

The module owners and the platform team. Keep the access level team-scoped: the findings name your buckets, roles and clusters.

Share a Terrascan report

Policy-as-code has a delivery problem. The policies live with the platform team, the violations live in the pipeline of whichever service tripped them, and the service team reads FAILED: AWS.S3Bucket.DS.High.1043 with no context about why anyone cares.

A rendered report closes that gap, because a rendered report can carry a comment.

SARIF → HTML

terrascan scan -i terraform -d . -o sarif > terrascan.sarif || true

pip install sarif-tools
sarif html terrascan.sarif --output terrascan.html

Swap -i terraform for k8s, helm, kustomize, docker or cft depending on the stack. Scan each type into its own report rather than concatenating — the audiences are different.

Or JUnit

terrascan scan -i terraform -d . -o junit-xml > terrascan.xml || true
junit2html terrascan.xml terrascan.html

Publish it

Drag terrascan.html into the app, or from CI:

curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html terrascan.html \
        --arg title "Terrascan — $GITHUB_REF_NAME" '{title: $title, html: $html}')"

Keep a separate unmuted terrascan scan --severity high step if high-severity findings should block.

Exceptions belong next to the finding

The realistic outcome of any policy scan is that some percentage of the findings are accepted risk. Today that acceptance lives in a skip_rules annotation, a Jira ticket and somebody's memory — three places, none of which is the report.

Anchored threads on the violation: "public read is intentional, this is the CDN origin bucket, approved in SEC-412." Recorded where the next person to read the finding will see it. See commenting on HTML.
Revisions across scheduled scans, so an exception that was supposed to be temporary is visibly not.
Access per report — team-scoped by default. See the sharing model.

Limits

Entry HTML: 5 MB. Assets: 25 MB per file, 250 MB and 500 files total.
60 requests/minute per token.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Publish a security report →