Alright, let's cut through the vendor fluff. I'm here because my cloud bill has a direct, inverse relationship with my sleep schedule, and unsecured IaC is a fantastic way to make both of those numbers explode. So when Mend started pushing their IaC scanning, my immediate, cynical thought was: "Great, another line item to justify."
I gave it a spin on a sprawling, multi-account AWS setup that's a beautiful disaster of Terraform and CloudFormation, sprinkled with some serverless framework configs. The goal? To see if it actually catches the stupid stuff that turns into **real, monthly-dollar stupid stuff**.
Here’s the raw, unfiltered take:
**The Good (The "Oh, that *is* useful"):**
* It's decent at flagging the classic, wallet-draining misconfigurations. Think publicly accessible S3 buckets (hello, egress fees and potential data exfiltration bills), RDS instances wide open to 0.0.0.0/0, and security groups with overly permissive rules. It maps these to compliance standards, but frankly, I care more about the CVE-Cloud-Credit.
* The integration into the CI/CD pipeline is smooth. It can break a build if you try to deploy an EC2 instance as a `t2.micro` but attach a 2TB EBS volume with provisioned IOPS. That's the kind of preventative cost control I can get behind.
* It caught a few obscure things I'd missed, like an overly permissive IAM trust policy on a Lambda function role that could have been assumed from another account. Potential cross-account chaos = potential cross-account billing chaos.
**The Annoying (The "Why are you yelling at me?"):**
* The noise. So much noise. It will flag *every* resource missing a tag, screaming about "cost allocation" with the fervor of a true believer. I get it, tags are important. But I don't need a critical severity alert because my test VPC is missing a `Department` tag.
* The "fix" suggestions are sometimes... theoretical. They'll tell you a setting is non-compliant with CIS AWS Foundations, but won't always give you the Terraform `aws_whatever` resource block snippet to fix it. You get a generic description. For the price, I want copy-paste remediation.
* The pricing model. Of course. It's another seat-based license on top of your existing Mend bill. You're paying for the privilege of being told your infrastructure is a financial liability.
**Was it worth it? The verdict:**
If you're in a heavily regulated industry or have a sprawling, multi-team infra where junior devs have deploy permissions, yes, it's probably worth the headache. It's a proactive guardrail against configuration drift that leads to surprise $10k bills.
If you're a small, tight team with strong FinOps practices already? You can replicate 80% of this with a combination of:
* **AWS Config Rules** (cheap, but slower)
* **Checkov** or **Terrascan** (open source, run in your pipeline)
* A **good old-fashioned Terraform plan review process**
Here's a crude but effective bash snippet I used *before* Mend to catch some low-hanging fruit, using the `terraform show -json` output:
```bash
terraform plan -out=tfplan
terraform show -json tfplan | jq -r '
.planned_values.root_module.resources[] |
select(.type == "aws_security_group") |
.values.name
'
# Then cross-ref with your internal "approved SGs" list
```
It's not elegant, but it cost me $0.
So, is Mend's IaC scanning *worth it*? It depends on how much you value consolidated reporting, pipeline integration, and having a vendor to blame. For me, it was a necessary evil that's caught a few expensive oopsies, but I still grumble writing the check.
Your cloud bill is too high.