aquasecurity/tfsec

Tfsec is a static analysis tool for Terraform, which is a widely used way of writing infrastructure configuration as code files. The tool reads those configuration files and looks for security mistakes before anything is actually deployed to a cloud provider. It does not run your infrastructure, it just checks the written configuration for problems the same way a spell-checker reads text. The tool checks configurations targeting all major cloud providers including AWS, Azure, Google Cloud, and DigitalOcean. It has hundreds of built-in rules covering common misconfigurations such as storage buckets that are publicly readable, security groups that allow traffic from any IP address, or encryption settings that have been left off. It can also evaluate more complex expressions in the configuration files, not just plain values, and it can follow references between different resource definitions to catch issues that span multiple files. You can run tfsec from the command line by pointing it at a directory. It produces output in several formats including plain text, JSON, CSV, and formats compatible with tools that collect security findings. The exit code signals whether any problems were found, which makes it straightforward to add to a continuous integration pipeline so that every code change is checked automatically. Plugins are available for VS Code and JetBrains editors. You can also run it as a Docker container or as a GitHub Action or Azure DevOps task. If a warning is not relevant to your project, you can silence it by adding a comment on the relevant line in the configuration file, and that suppression is tracked in the code rather than in a separate config file. The README notes that tfsec has been merged into Trivy, a broader security scanning tool also maintained by Aqua Security. Tfsec remains available, but new development is happening in Trivy, and the maintainers encourage users to migrate. A migration guide is linked from the repository.