Trivy 0.73.0 Enhances IaC Security Scanning with Rego Export and Azure Support

Aqua Security has released Trivy version 0.73.0, a significant update to its popular open-source vulnerability and misconfiguration scanner. Key features in this release include the ability to export unresolvable fields of Infrastructure as Code (IaC) types to Rego, and the addition of public network support for Azure Storage Account misconfiguration scanning. The update was published on August 3, 2026, as detailed in the project's changelog. For cloud and DevOps practitioners, these enhancements are crucial for maintaining a robust security posture in an increasingly complex IaC landscape. The Rego export functionality provides unprecedented flexibility in defining custom security policies. Instead of being limited to Trivy's built-in checks, security engineers can now leverage the full power of Open Policy Agent (OPA) and Rego to write highly specific rules that account for unique organizational requirements or emerging threat patterns that might not yet be covered by standard tooling. This is particularly valuable for complex, multi-cloud environments where generic policies often fall short. The Azure Storage Account public network support directly addresses a common and critical misconfiguration. Publicly accessible storage accounts are frequent targets for data breaches, and this new capability ensures that Trivy can comprehensively identify such exposures, providing immediate actionable insights to prevent potential incidents. This release fits squarely within the broader trend of "shift-left" security, where security concerns are integrated earlier into the development lifecycle. As IaC adoption continues to grow, tools like Trivy are evolving to provide more granular and customizable security checks at the provisioning stage. The integration with policy-as-code frameworks like OPA/Rego is a natural progression, allowing organizations to codify their security governance and enforce it consistently across all IaC templates, regardless of the cloud provider or IaC tool (e.g., Terraform, CloudFormation, Pulumi). This mirrors similar advancements seen in other security tools and platforms, which are increasingly offering extensible policy engines to adapt to diverse enterprise needs and evolving compliance requirements. The focus on specific cloud services like Azure Storage Accounts also reflects the ongoing need for cloud-specific security intelligence, as generic security scanning often misses nuances of individual cloud provider configurations. Practitioners should prioritize upgrading to Trivy 0.73.0 to leverage these new capabilities. Security teams can immediately begin defining custom Rego policies for their IaC repositories, focusing on critical, unresolvable fields that previously might have required manual review or bespoke scripting. This will reduce manual effort and improve the accuracy of automated checks. For Azure users, it's imperative to re-scan existing IaC configurations for Storage Accounts to identify any public network exposures that might have been missed by previous scans. This proactive measure can prevent potential data leaks and ensure compliance with security best practices. Furthermore, this update underscores the importance of a continuous security feedback loop within CI/CD pipelines, where IaC changes are automatically scanned and validated against both built-in and custom policies before deployment. Organizations should also consider investing in training for their security and DevOps teams on Rego to fully capitalize on the enhanced policy definition capabilities.