Question 1

Does the npm package send my code anywhere?

Accepted Answer

No. The analysis runs entirely inside your CI/CD pipeline. Your IaC files never leave your infrastructure. When IACREVIEW_TOKEN is set, only the analysis result - cost numbers, finding counts, resource names - is sent to our API to populate your dashboard. No source code is transmitted.

Question 2

Do I need to change my existing CDK or Terraform pipeline?

Accepted Answer

You add one step to your existing pipeline. For Bitbucket + CodePipeline, that's adding one CodeBuild action. For GitHub Actions, it's adding 4 lines to your workflow YAML. Your deployment pipeline is unchanged.

Question 3

Does it work if my team uses both CDK and Terraform in different repos?

Accepted Answer

Yes. The framework is auto-detected per repository. A CDK TypeScript repo gets CDK-aware analysis. A Terraform repo gets Terraform plan analysis. A mixed repo gets both, combined in one PR comment. No configuration needed.

Question 4

How does the multi-environment comment work?

Accepted Answer

Each time your pipeline stage (test, QA, prelive, prod) runs the tool, it appends its result to the same PR comment. The comment updates live as stages complete. If you have 4 pipeline stages, the PR comment shows all 4 environments when they're all done.

Question 5

What's the difference between the free npm package and the paid dashboard?

Accepted Answer

The npm package is fully functional forever - it posts PR comments with complete cost, security, and policy analysis. The paid dashboard adds history (you can see cost trends over 12 months), team analytics, Slack notifications, and the centralized policy management UI. If you only need the PR comment, you'll never need to pay.

Question 6

Does it work with CDK Java?

Accepted Answer

Yes, through the Docker container mode or in CodeBuild with Java runtime configured. CDK Java synthesizes to CloudFormation, which IaCReview analyzes for cost and security. CDK diff parsing works natively since cdk diff output format is the same regardless of the CDK language used.

Question 7

Can I use this if my team uses AWS CodePipeline with Bitbucket?

Accepted Answer

This is one of the primary use cases. The tool reads CODEBUILD_WEBHOOK_TRIGGER to extract the PR ID from Bitbucket. It then posts the analysis comment back to the Bitbucket PR. Full documentation is available for this exact setup.

Question 8

How is IaCReview different from Infracost?

Accepted Answer

Infracost is excellent at Terraform cost estimation. IaCReview combines cost estimation (using the same AWS Pricing API) with security scanning (Checkov), policy enforcement (custom rules), and native CDK diff parsing - which shows exactly what changes at the CDK stack level including resource replacements. Infracost's CDK support works through CloudFormation synthesis; IaCReview parses the cdk diff output directly. If you use Terraform only, Infracost is a great choice. If you use CDK, or need security + policy alongside cost, IaCReview provides the unified comment.

Question 9

Can I use my own security rules instead of Checkov?

Accepted Answer

Yes. You can disable Checkov entirely and use only the custom policy rules. You can also combine Checkov findings with your own rules. Enterprise plans support OPA/Rego policy integration.

Question 10

Is there a self-hosted option?

Accepted Answer

The npm package and CLI run entirely in your own infrastructure by default. For the dashboard backend, a self-hosted option is available on Enterprise plans - deploy to your own AWS account or Kubernetes cluster.

Every infra change, reviewed before it merges.

What you get on every pull request

Works with your stack

Pricing