tfsec
A static analysis security scanner for Terraform code that identifies misconfigurations across major cloud providers.
What is tfsec?
tfsec is a static analysis security scanner specifically designed for Terraform infrastructure as code. It analyzes Terraform configurations to identify potential security misconfigurations and compliance violations before deployment to cloud environments. The tool helps prevent security breaches by catching issues early in the development cycle.
DevOps engineers, infrastructure developers, and security teams working with Terraform to manage cloud infrastructure across AWS, Azure, GCP, Kubernetes, and other platforms.
Developers choose tfsec for its deep Terraform-specific analysis capabilities, comprehensive multi-cloud coverage, and seamless integration into CI/CD pipelines. It provides fast, accurate security feedback directly in the development workflow.
Overview
Tfsec is now part of Trivy
Use Cases
Best For
- Scanning Terraform code for AWS security misconfigurations before deployment
- Integrating security checks into Terraform CI/CD pipelines
- Checking Kubernetes Terraform configurations for compliance violations
- Identifying public exposure risks in cloud infrastructure code
- Enforcing security policies across multi-cloud Terraform deployments
- Automating security reviews for infrastructure as code repositories
Not Ideal For
- Projects using multiple infrastructure as code tools beyond Terraform (e.g., CloudFormation, Pulumi)
- Teams requiring guaranteed long-term support and active feature development
- Organizations needing commercial support or extensive third-party integrations
- Environments where scanning must include non-cloud or application code security issues
Pros & Cons
Pros
Evaluates HCL expressions, Terraform functions, and resource relationships, not just literal values, reducing false positives.
Includes hundreds of built-in rules for AWS, Azure, GCP, Kubernetes, and minor providers, covering most cloud deployments.
Capable of quickly scanning huge repositories, making it efficient for CI/CD pipelines with large codebases.
Supports inline comments with expiration dates for ignoring warnings, aiding in managed technical debt and compliance.
Cons
The project is being phased out in favor of Trivy, meaning future updates, new checks, and engineering focus will shift away from tfsec.
Only scans Terraform code, not other IaC languages or general application security, restricting its use in mixed environments.
For Terraform <0.12, only v0.1.3 of tfsec is available with fewer checks and reduced functionality, hindering legacy projects.
Frequently Asked Questions
Related Projects
terraformerCLI tool to generate terraform files from existing infrastructure (reverse Terraform). Infrastructure to Code
InfracostCloud cost intelligence for engineers, AI coding agents, and CI/CD 💰📉 Shift FinOps Left!
TerragruntTerragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu/Terraform to scale.
atlantisTerraform Pull Request Automation
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.