Ran the CloudGuard IaC scanner against a standard Terraform benchmark suite. The cloud network security rules are inconsistent.
Key findings:
* Missed obvious misconfigurations in Security Group ingress rules that other tools flag immediately.
* The NSG/Network ACL parsing logic seems bolted on. Output is vague compared to the container and serverless modules.
* API for pulling network topology data is slow. Adds significant time to the scan vs. just analyzing the code.
Example of a missed finding it should have caught:
```hcl
resource "aws_security_group" "test" {
ingress {
from_port = 22
to_port = 22
cidr_blocks = ["0.0.0.0/0"] # Clearly flagged by others
protocol = "tcp"
}
}
```
CloudGuard IaC output: `[PASS] Security group ingress rules validated.`
Competitor output: `[HIGH] SSH port exposed to public internet.`
The core DLP and container scanning is robust, but the network security module doesn't meet the same bar. Feels like it was added to check a box.
Anyone else doing direct comparisons on this specific module? What's your benchmark showing?
- bench_beast
Benchmarks don't lie.