diff --git a/.github/workflows/snyk-iac.yml b/.github/workflows/snyk-iac.yml
new file mode 100644
index 0000000000..58b96e75d8
--- /dev/null
+++ b/.github/workflows/snyk-iac.yml
@@ -0,0 +1,15 @@
+   name: Snyk IaC gate
+   on:
+     pull_request:
+       paths: ['terraform/**']
+
+   jobs:
+     iac:
+       runs-on: ubuntu-latest
+       env:
+         SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+       steps:
+         - uses: actions/checkout@v4
+         - uses: snyk/actions/setup@master
+         - name: Scan Terraform
+           run: snyk iac test terraform/ --severity-threshold=high
diff --git a/terraform/main.tf b/terraform/main.tf
new file mode 100644
index 0000000000..8f380cc0e5
--- /dev/null
+++ b/terraform/main.tf
@@ -0,0 +1,26 @@
+provider "aws" {
+  region = "eu-central-1"
+}
+
+resource "aws_s3_bucket" "demo" {
+  bucket = "app-assets-eu-central-1"
+}
+
+resource "aws_s3_bucket_public_access_block" "demo" {
+  bucket                  = aws_s3_bucket.demo.id
+  block_public_acls       = false
+  block_public_policy     = false
+  ignore_public_acls      = false
+  restrict_public_buckets = false
+}
+
+resource "aws_security_group" "demo" {
+  name = "demo-open-sg"
+
+  ingress {
+    from_port   = 22
+    to_port     = 22
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}