Google Cloud Terraform Policy Validation vs KICS

Google Cloud Terraform Policy Validation checks Terraform plans against organizational security and governance constraints before infrastructure changes are applied. The `gcloud beta terraform vet` command evaluates Terraform plan JSON, retrieving project data through Google Cloud APIs. It can flag violations, issue warnings, or halt a deployment before production; it returns exit code 0 when no violations are found and 2 when they are. Platform teams can place validation between plan and apply in CI/CD workflows using Cloud Build, Jenkins, or GitHub Actions. The command accepts Terraform 0.12 or later plan JSON and requires a policy library and the Google Cloud CLI `terraform-tools` component. Policies can cover supported resources from Terraform's google and google-beta providers, and constraints can be reused with other tools that support the framework. The command is free and client-side. The feature is in Preview under Pre-GA terms, where support may be limited. Security Command Center IaC validation has separate requirements: Premium or Enterprise activation at the organization level and a specified role. That workflow also requires Terraform Google provider version 5.5 or later.

KICS is a free, open-source static analysis solution powered by Checkmarx. It scans Infrastructure as Code for security vulnerabilities, compliance issues, and configuration mistakes across Terraform, Kubernetes, Docker, AWS CloudFormation, Ansible, Helm, Google Deployment Manager, AWS SAM, Microsoft ARM, Azure Blueprints, OpenAPI, Pulumi, Crossplane, Knative, and Serverless Framework files. Its security queries can be edited, extended, or supplemented with new queries, using OPA Rego policy language. Documented CI and delivery integrations include GitHub Actions, GitLab CI, Jenkins, Azure Pipelines, CircleCI, Bitbucket Pipelines, Terraform Cloud, AWS CodeBuild, pre-commit hooks, and others. A Visual Studio Code extension can scan automatically. KICS runs as a Docker image, from source, or through downloadable Linux, Windows, and macOS releases. Reports can be exported as JSON, SARIF, GitLab SAST, JUnit, HTML, PDF, CycloneDX, ASFF, or CSV. Terraform functions and environment variables are unsupported, and unofficial or custom Terraform modules are not supported.