> For the complete documentation index, see [llms.txt](https://docs.opsmx.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.opsmx.com/code-to-cloud-security-and-scanners/artifact-security/iac-scan-artifacts.md).

# IAC Scan Artifacts

The **IaC Scanning** page gives you a centralized view to monitor and manage the security posture of all Infrastructure as Code (IaC) artifacts — such as Terraform, CloudFormation, Kubernetes manifests, and Helm charts — used across your environments. From here, you can assess misconfigurations and risks, review detailed scan reports, and take timely action to remediate issues before they reach production.

* Navigate to **Security Issues** → **IaC Scanning**.
* The panel at the top displays the total number of IaC artifacts scanned, along with their risk status:
  * **Critical Risk** - The artifacts that are of critical risk. 
  * **High Risk** - The artifacts that are of high risk. 
  * **Medium Risk** - The artifacts that are of medium risk. 
  * **Low Risk** - The artifacts that are of low risk.

<figure><img src="/files/fnSLXig7uhN4YujumJPf" alt=""><figcaption></figcaption></figure>

The panel below displays the various details of the artifacts.

* **Artifact** - Displays the name/identifier of the IaC artifact (e.g., Terraform plan, Helm chart, Kubernetes manifest) that was scanned.
* **Artifact Version** - Displays the specific version or tag of the artifact at the time of the IaC security scan.
* **Semantic Tags** - Displays the human-readable labels attached to the artifact for categorization and filtering purposes.
* **Artifact SHA** - Displays the cryptographic SHA hash of the artifact that uniquely identifies its exact content and ensures integrity.
* **Open Issues** - Displays the count of currently unresolved security findings or policy violations detected in the artifact.
* **Vulnerability** - Displays the severity-bucketed summary (Critical / High / Medium / Low) of CVEs or misconfigurations found in the artifact.
* **Created On** - Displays the timestamp indicating when this artifact record or scan entry was first created in the system.
* **Built by** - Displays the CI/CD pipeline, user, or tool that produced and submitted the artifact for scanning.
* **Source Repository** - Displays the URL or name of the version-control repository where the IaC source code originates.
* **Branch** - Displays the Git branch from which the artifact was built or scanned.
* **Team** - Displays the organizational team or group that owns or is responsible for this artifact.
* **OSS** - On clicking **View**, it displays the open-source page software components detected in the artifact along with their associated license/risk status.
* **DBOM Status** - Displays the DBOM risk status of the artifact.
* **Actions** - On clicking **Actions**, The scan report for the artifact can be downloaded.&#x20;