A static analysis security scanner for Terraform code that identifies misconfigurations across major cloud providers.
tfsec is a static analysis security scanner for Terraform code that identifies potential misconfigurations and security vulnerabilities across major cloud providers. It analyzes Terraform configurations to detect security risks before infrastructure is deployed, helping prevent cloud security breaches. The tool evaluates HCL expressions, Terraform functions, and relationships between resources to provide comprehensive security coverage.
DevOps engineers, infrastructure developers, and security teams working with Terraform to manage cloud infrastructure across AWS, Azure, GCP, Kubernetes, and other platforms.
Developers choose tfsec for its specialized focus on Terraform security, comprehensive multi-cloud coverage, and seamless integration into CI/CD pipelines. It offers fast scanning of large codebases, extensive built-in rules, and the ability to customize checks with Rego policies.
Tfsec is now part of Trivy
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Covers AWS, Azure, GCP, Kubernetes, and other platforms with hundreds of built-in rules, as listed in the README's included checks.
Evaluates HCL expressions, Terraform functions, and resource relationships quickly, capable of scanning huge repositories, per the features section.
Offers IDE plugins for VSCode, JetBrains, and Vim, and seamless CI/CD integration via GitHub Actions and Azure DevOps tasks.
Supports multiple output formats like JSON, SARIF, and CSV, and allows custom security policies using Rego, as detailed in the usage sections.
The project is being migrated to Trivy, with engineering attention directed away, reducing future updates and long-term support, as stated in the migration note.
Only scans Terraform code, not compatible with other Infrastructure as Code platforms, which restricts its utility in mixed environments.
As a static scanner, it may generate false positives and cannot detect security issues that only manifest at runtime, relying solely on code analysis.