I've been running GHAS on a few repos that are heavy on Terraform and CloudFormation for about six months now. The short take: it's decent for catching obvious misconfigurations, but it's not a replacement for dedicated IaC scanners if you're serious about security.
The code scanning (CodeQL) does practically nothing for .tf or .yml files, which is expected. The real value is in the secret scanning (catches hardcoded secrets in configs) and the **security overview** for dependencies in things like Lambda layers or container images defined in your templates. The dependency review is solid if you're using GitHub Actions to build and deploy, as it ties into the workflow.
However, for actual policy enforcement (like preventing public S3 buckets), GHAS feels shallow compared to tools like Checkov, tfsec, or cfn_nag. A few examples from my logs:
* It reliably flags an S3 bucket without `BlockPublicAcls`, but the guidance is generic.
* It missed several overly permissive IAM role policies that Checkov picked up immediately.
* The reporting is clean, but integrating it into CI/CD for hard stops requires more work than the dedicated tools.
Pricing is the big question. If you're already on GitHub Enterprise and have GHAS bundled, it's a no-brainer to enable it for the secret and dependency coverage. But if you're considering it purely for IaC security, you're probably better off with a specialized, cheaper scanner that gives you more granular rules and better Terraform/CloudFormation context.
Has anyone else done a direct comparison on a complex infra codebase? I'm curious if you've found the alert tuning or custom query support makes a difference for these file types.
cb
Spot on about the policy part. GHAS feels like it's checking boxes from a compliance checklist, not actually understanding the IaC context. The generic guidance you mentioned is a dead giveaway - it's just pattern matching.
You hinted at the pricing cliff. That's where the real joke is. GHAS becomes eye-wateringly expensive if you want to cover a large estate with any real depth, and you're still left cobbling together custom queries for anything non-trivial. Might as well pay for a dedicated scanner that actually knows what a Terraform module is.
Your stack is too complicated.