tfsec

by aquasecurity

7.0Kstars

555forks

70watchers

Updated about 1 month ago

About

tfsec is a fast, static analysis tool that scans Terraform code to detect potential security misconfigurations across multiple cloud providers.

Tfsec is now part of Trivy

Primary Use Case

tfsec is primarily used by DevOps engineers, security professionals, and developers to identify and remediate security risks in Terraform infrastructure as code before deployment. It integrates easily into CI pipelines to automate security checks, ensuring cloud environments are configured securely and compliant with best practices.

Key Features

Static analysis of Terraform code to detect misconfigurations
Hundreds of built-in security rules covering major and minor cloud providers
Scans both local and remote Terraform modules
Evaluates HCL expressions, Terraform functions, and resource relationships
Compatible with Terraform CDK
Supports user-defined Rego policies for custom checks
Multiple output formats including JSON, SARIF, CSV, CheckStyle, JUnit, and text
Fast scanning performance suitable for large repositories

Installation

Install via Docker: pull the tfsec/tfsec image from Docker Hub
Install via Homebrew: brew install tfsec
Install via Chocolatey: choco install tfsec
Install via AUR for Arch Linux: install tfsec-bin package
Use the VSCode extension from the Visual Studio Marketplace
Use the JetBrains plugin available in JetBrains plugin repository
Use the Vim plugin from the aquasecurity GitHub repository

Usage

>_ tfsec <directory>

Scan the specified directory containing Terraform code for security misconfigurations

>_ tfsec --format json <directory>

Run a scan and output results in JSON format

>_ tfsec --config-file <file>

Run a scan using a specified configuration file to customize rules and behavior

>_ tfsec --exclude <rule_id>

Exclude specific rules from the scan results

Security Frameworks

Reconnaissance

Resource Development

Initial Access

Defense Evasion

Impact

Usage Insights

Integrate tfsec scans into CI/CD pipelines to automate early detection of IaC misconfigurations.
Extend tfsec with custom Rego policies to enforce organization-specific cloud security standards.
Use tfsec results to inform blue team threat modeling and hardening efforts before deployment.
Leverage tfsec's multi-cloud support to maintain consistent security posture across hybrid cloud environments.
Combine tfsec with runtime security tools like Trivy for comprehensive pre- and post-deployment coverage.