KICS vs Serverspec

KICS is a free, open-source static analysis solution powered by Checkmarx. It scans Infrastructure as Code for security vulnerabilities, compliance issues, and configuration mistakes across Terraform, Kubernetes, Docker, AWS CloudFormation, Ansible, Helm, Google Deployment Manager, AWS SAM, Microsoft ARM, Azure Blueprints, OpenAPI, Pulumi, Crossplane, Knative, and Serverless Framework files. Its security queries can be edited, extended, or supplemented with new queries, using OPA Rego policy language. Documented CI and delivery integrations include GitHub Actions, GitLab CI, Jenkins, Azure Pipelines, CircleCI, Bitbucket Pipelines, Terraform Cloud, AWS CodeBuild, pre-commit hooks, and others. A Visual Studio Code extension can scan automatically. KICS runs as a Docker image, from source, or through downloadable Linux, Windows, and macOS releases. Reports can be exported as JSON, SARIF, GitLab SAST, JUnit, HTML, PDF, CycloneDX, ASFF, or CSV. Terraform functions and environment variables are unsupported, and unofficial or custom Terraform modules are not supported.

Serverspec is an open-source Ruby gem for writing RSpec tests that verify server configuration. It examines actual machine state by executing commands locally or through SSH, WinRM, and the Docker API, without requiring agent software on target servers. Checks cover packages, services, files, ports, users, Docker containers and images, Windows features, and X.509 certificates and private keys. Both RSpec should and expect syntax are supported. Serverspec can accompany Puppet, Ansible, CFEngine, Itamae, and Chef, with infrastructure-code refactoring stated as its central aim. The tutorial names Linux distributions, macOS, Windows, BSD systems, Solaris, SmartOS, and others, while noting incomplete support for some. Each suite targets one machine or Docker container, so separate RSpec commands are advised for separate targets. Install through Bundler or gem install serverspec. It is MIT licensed and maintained by Gosuke Miyashita.