Does IaCReview send my code anywhere?

The free CLI sends nothing to us. It runs cdk diff in your pipeline and posts the comment straight to your Git platform. With the IaCReview plan, the CLI uploads the parsed diff and the synthesized CloudFormation properties of the resources that changed, so the engine can price and scan them. Your source code is not uploaded, except short snippets around a finding when AI fix suggestions are on. Those snippets are discarded once the suggestion is generated, and you can turn the feature off.

Which infrastructure tools does it support?

AWS CDK, in every language CDK supports: TypeScript, JavaScript, Python, Java, Go, and C#. IaCReview reads the output of cdk diff and the synthesized templates in cdk.out, so it works the same way whatever language your app is written in.

Do I need to change my pipeline?

You add one step after your app is built. On GitHub it is one Action step. On GitLab, Bitbucket, or any other CI, it is one command. Your deployment steps do not change.

What is the difference between the free CLI and the IaCReview plan?

The free CLI and Action post a summary of the resources each stack adds, modifies, replaces, and removes, with warnings for replacements and IAM changes. The IaCReview plan adds cost impact, security scanning, policy checks, a merge verdict, multi-environment comments, and the team dashboard, all in the same comment.

How does the multi-environment comment work?

Run the tool after cdk diff in each pipeline stage, passing --env with the stage name. Each run adds its results to the same pull request comment, which updates as stages complete. Stages that have not reported yet are shown as pending.

Can it fail the pipeline when a change is risky?

Yes. Turn on fail-on-block (or set CDK_DIFF_FAIL_ON_BLOCK=true) and the step exits with code 2 when the verdict is Merge blocked, so you can make it a required check. By default a merge is blocked by a high-severity finding, a replacement in a protected environment such as production, or a policy violation.

Does it work with AWS CodePipeline and CodeBuild?

Yes. Run the CLI in a CodeBuild step and set the variables for your Git platform. For Bitbucket, that is BITBUCKET_PR_ID, BITBUCKET_WORKSPACE, BITBUCKET_REPO_SLUG, and BITBUCKET_ACCESS_TOKEN. The documentation lists the variables for each platform.

Can I use my own security rules?

Yes. You can turn the security scanner off and rely on your policy rules alone, choose between Checkov and the built-in scanner, and set the severity that blocks a merge.

How is IaCReview different from Infracost?

Infracost focuses on cost estimation. IaCReview is built around cdk diff, so it also shows the resources each stack adds, modifies, replaces, and removes, and it combines cost with security findings, policy checks, and a merge verdict in one comment. If cost estimates are all you need, Infracost is a good choice.

Is there a self-hosted option?

The free CLI always runs in your own pipeline. The analysis engine can also run self-hosted, and Enterprise customers can deploy the IaCReview service to their own AWS account. Contact us for details.

Every infra change, reviewed before it merges.

IaCReview posts one pull request comment for every AWS CDK change: what it changes, what it costs, what it exposes, and whether it meets your team's rules. It runs in the pipeline you already have, on GitHub, GitLab, or Bitbucket.

What you get on every pull request

Resource diff - the resources each stack adds, modifies, replaces and removes. Free and open source.
Cost impact - the monthly and annual change, priced from the live AWS Pricing API before anything is deployed.
Security findings - Checkov findings mapped back to the CDK source file and line, exportable as SARIF to GitHub code scanning.
Policy checks - required tags, banned resource types and naming rules, managed centrally with per-repository overrides.
Replacement warnings - resources that will be deleted and recreated, with the property that causes it and the data-loss risk.
AI fix suggestions - a code change for a finding, posted as a one-click GitHub suggestion.

Works with your stack

AWS CDK in any language (TypeScript, JavaScript, Python, Java, Go and C#), run from GitHub Actions, GitLab CI/CD, Bitbucket Pipelines, or any other CI system.

Pricing

The CLI and GitHub Action are free and open source. Starter is $49 per month and Professional is $149 per month, adding cost, security and policy analysis, the team dashboard, and compliance evidence.

See pricing · Frequently asked questions · Open-source CLI on GitHub