Top Related Projects
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.
Linting tool for CloudFormation templates
Snyk CLI scans and monitors your projects for security vulnerabilities.
Protect and discover secrets using Gitleaks 🔑
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
Quick Overview
tfsec is a static analysis security scanner for Terraform code. It checks for potential security issues and best practices in Infrastructure as Code (IaC) configurations, helping developers identify and mitigate vulnerabilities before deployment.
Pros
- Integrates easily into CI/CD pipelines for automated security checks
- Supports custom rules and can be extended to fit specific organizational needs
- Provides clear, actionable output with severity levels and remediation advice
- Regularly updated to cover new security threats and Terraform features
Cons
- May produce false positives in complex or unconventional configurations
- Requires manual review and interpretation of results for optimal security
- Limited to Terraform-specific checks, not a comprehensive security solution
- Can be resource-intensive for very large Terraform projects
Getting Started
To install and run tfsec:
# Install tfsec
brew install tfsec
# Run tfsec on a Terraform directory
tfsec /path/to/terraform/files
# Run tfsec with custom rules
tfsec --custom-check-dir /path/to/custom/checks /path/to/terraform/files
# Output results in JSON format
tfsec --format json /path/to/terraform/files > results.json
To ignore specific checks or resources:
# In your Terraform file
resource "aws_security_group" "example" {
# tfsec:ignore:aws-vpc-no-public-ingress-sgr
ingress {
from_port = 80
to_port = 80
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
}
For more advanced usage and configuration options, refer to the official documentation.
Competitor Comparisons
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
Pros of Checkov
- Supports multiple IaC frameworks (Terraform, CloudFormation, Kubernetes, etc.)
- Offers a wider range of security and compliance checks
- Provides integration with CI/CD pipelines and cloud environments
Cons of Checkov
- Can be slower to run compared to tfsec, especially on large codebases
- May require more configuration and setup for advanced features
Code Comparison
tfsec example:
resource "aws_s3_bucket" "my_bucket" {
bucket = "my-bucket"
acl = "private"
}
Checkov example:
- name: Ensure S3 bucket has encryption enabled
resource: aws_s3_bucket
check:
- encryption_enabled: true
Both tools can detect security issues in IaC code, but Checkov offers more flexibility in defining custom policies and supports a broader range of infrastructure definitions. tfsec is more focused on Terraform-specific security checks and generally runs faster. The choice between the two depends on the specific needs of your project and the variety of IaC tools you use.
Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.
Pros of Terrascan
- Supports multiple IaC languages (Terraform, Kubernetes, Helm, Kustomize, Dockerfiles)
- Offers a policy-as-code framework for custom rule creation
- Provides integration with CI/CD pipelines and various cloud platforms
Cons of Terrascan
- Less frequent updates compared to tfsec
- Steeper learning curve for custom policy creation
- Slower scan times for large codebases
Code Comparison
Terrascan:
terrascan scan -i terraform
tfsec:
tfsec .
Both tools can be easily integrated into CI/CD pipelines, but Terrascan offers more flexibility in terms of supported IaC languages. tfsec, on the other hand, focuses specifically on Terraform and provides faster scan times.
Terrascan's policy-as-code framework allows for more customization, but it may require more effort to create and maintain custom rules. tfsec offers a simpler approach with built-in rules and easier configuration.
While both tools are valuable for securing infrastructure code, the choice between them depends on specific project requirements, the range of IaC languages used, and the desired level of customization.
Linting tool for CloudFormation templates
Pros of cfn_nag
- Specifically designed for AWS CloudFormation templates
- Supports both JSON and YAML formats
- Includes a comprehensive set of rules for AWS-specific security checks
Cons of cfn_nag
- Limited to CloudFormation templates, not as versatile for other IaC tools
- May require more manual configuration for custom rules
- Less frequent updates compared to tfsec
Code Comparison
cfn_nag:
require 'cfn-nag'
cfn_nag = CfnNag.new
result = cfn_nag.audit(cloudformation_string: File.read('template.yml'))
puts result.to_s
tfsec:
tfsec .
tfsec offers a simpler command-line interface for scanning Terraform code, while cfn_nag requires a bit more setup in Ruby to perform scans on CloudFormation templates.
Both tools provide valuable security insights for infrastructure-as-code, but they target different ecosystems. cfn_nag is specialized for AWS CloudFormation, offering deep integration with AWS-specific resources and best practices. tfsec, on the other hand, is more versatile, supporting multiple cloud providers through Terraform, and offers a more streamlined user experience with its simple CLI interface and automatic updates.
Snyk CLI scans and monitors your projects for security vulnerabilities.
Pros of Snyk CLI
- Broader scope: Covers multiple languages and package managers beyond just Terraform
- Integrates with Snyk's vulnerability database for up-to-date security checks
- Offers remediation advice and automatic fix pull requests
Cons of Snyk CLI
- Requires an account and potentially a paid plan for full features
- May have a steeper learning curve due to its broader functionality
- Can be slower to run compared to tfsec, especially for large projects
Code Comparison
tfsec example:
tfsec .
Snyk CLI example:
snyk iac test .
Both tools can scan Terraform code, but their usage and output differ. tfsec is more focused on Terraform-specific issues, while Snyk CLI provides a wider range of security checks across multiple infrastructure-as-code formats.
tfsec is generally faster and easier to set up for Terraform-specific scanning, while Snyk CLI offers more comprehensive security analysis but may require more configuration and potentially a paid subscription for full functionality.
Protect and discover secrets using Gitleaks 🔑
Pros of gitleaks
- Focuses on detecting secrets and sensitive information in git repositories
- Supports scanning multiple version control systems (Git, SVN, Mercurial)
- Highly customizable with regex patterns and rules
Cons of gitleaks
- Limited to secret detection, not a comprehensive security scanner
- May produce false positives, requiring manual review
- Doesn't provide remediation suggestions for found issues
Code comparison
gitleaks:
func (s *Scanner) Scan(ctx context.Context) error {
for _, fragment := range s.fragments {
for _, rule := range s.config.Rules {
if rule.Match(fragment) {
s.findings = append(s.findings, NewFinding(rule, fragment))
}
}
}
return nil
}
tfsec:
func (scanner *Scanner) Scan(ctx context.Context) (results []Result, err error) {
for _, check := range scanner.checks {
checkResults, err := check.Run(ctx, scanner.blocks)
if err != nil {
return nil, err
}
results = append(results, checkResults...)
}
return results, nil
}
Both tools use a similar scanning approach, iterating through rules or checks and applying them to the scanned content. However, gitleaks focuses on secret detection in git history, while tfsec analyzes Terraform code for security issues.
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
Pros of Semgrep
- Supports multiple programming languages, not limited to infrastructure-as-code
- Highly customizable with user-defined rules and patterns
- Integrates well with various CI/CD pipelines and development workflows
Cons of Semgrep
- Requires more setup and configuration for specific use cases
- May have a steeper learning curve for creating custom rules
- Not specialized for infrastructure-as-code scanning like tfsec
Code Comparison
Semgrep rule example:
rules:
- id: detect-hardcoded-secret
pattern: $X = "..."
message: "Potential hardcoded secret detected"
severity: WARNING
tfsec check example:
check "aws_iam_policy_document" {
resource "aws_iam_policy_document" {
statement {
effect = "Allow"
actions = ["*"]
resources = ["*"]
}
}
}
While Semgrep offers a more generic approach to code scanning across multiple languages, tfsec is specifically tailored for Terraform and infrastructure-as-code security checks. Semgrep's flexibility allows for broader application, but tfsec provides out-of-the-box specialized checks for cloud infrastructure configurations.
Convert 
designs to code with AI
Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.
Try Visual CopilotREADME
ð£ tfsec to Trivy Migration
As part of our goal to provide a comprehensive open source security solution for all, we have been consolidating all of our scanning-related efforts in one place, and that is Trivy.
Over the past year, tfsec has laid the foundations to Trivy's IaC & misconfigurations scanning capabilities, including Terraform scanning, which has been natively supported in Trivy for a long time now.
Going forward we want to encourage the tfsec community to transition over to Trivy. Moving to Trivy gives you the same excellent Terraform scanning engine, with some extra benefits:
- Access to more languages and features in the same tool.
- Access to more integrations with tools and services through the rich ecosystem around Trivy.
- Commercially supported by Aqua as well as by a the passionate Trivy community. tfsec will continue to remain available for the time being, although our engineering attention will be directed at Trivy going forward.
tfsec to Trivy migration guide
For further information on how Trivy compares to tfsec and moving from tfsec to Trivy, do have a look at the migration guide.
Overview
tfsec uses static analysis of your terraform code to spot potential misconfigurations.
Features
- :cloud: Checks for misconfigurations across all major (and some minor) cloud providers
- :no_entry: Hundreds of built-in rules
- :nesting_dolls: Scans modules (local and remote)
- :heavy_plus_sign: Evaluates HCL expressions as well as literal values
- :arrow_right_hook: Evaluates Terraform functions e.g.
concat() - :link: Evaluates relationships between Terraform resources
- :toolbox: Compatible with the Terraform CDK
- :no_good: Applies (and embellishes) user-defined Rego policies
- :page_with_curl: Supports multiple output formats: lovely (default), JSON, SARIF, CSV, CheckStyle, JUnit, text, Gif.
- :hammer_and_wrench: Configurable (via CLI flags and/or config file)
- :zap: Very fast, capable of quickly scanning huge repositories
- :electric_plug: Plugins for popular IDEs available (JetBrains, VSCode and Vim)
- :house_with_garden: Community-driven - come and chat with us on Slack!
Recommended by Thoughtworks
Rated Adopt by the Thoughtworks Tech Radar:
For our projects using Terraform, tfsec has quickly become a default static analysis tool to detect potential security risks. It's easy to integrate into a CI pipeline and has a growing library of checks against all of the major cloud providers and platforms like Kubernetes. Given its ease of use, we believe tfsec could be a good addition to any Terraform project.
Example Output
Installation
Install with brew/linuxbrew
brew install tfsec
Install with Chocolatey
choco install tfsec
Install with Scoop
scoop install tfsec
Bash script (Linux):
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
You can also grab the binary for your system from the releases page.
Alternatively, install with Go:
go install github.com/aquasecurity/tfsec/cmd/tfsec@latest
Please note that using go install will install directly from the master branch and version numbers will not be reported via tfsec --version.
Signing
The binaries on the releases page are signed with the tfsec signing key D66B222A3EA4C25D5D1A097FC34ACEFB46EC39CE
Form more information check the signing page for instructions on verification.
Usage
tfsec will scan the specified directory. If no directory is specified, the current working directory will be used.
The exit status will be non-zero if tfsec finds problems, otherwise the exit status will be zero.
tfsec .
Use with Docker
As an alternative to installing and running tfsec on your system, you may run tfsec in a Docker container.
There are a number of Docker options available
| Image Name | Base | Comment |
|---|---|---|
| aquasec/tfsec | alpine | Normal tfsec image |
| aquasec/tfsec-alpine | alpine | Exactly the same as aquasec/tfsec, but for those whole like to be explicit |
| aquasec/tfsec-ci | alpine | tfsec with no entrypoint - useful for CI builds where you want to override the command |
| aquasec/tfsec-scratch | scratch | An image built on scratch - nothing frilly, just runs tfsec |
To run:
docker run --rm -it -v "$(pwd):/src" aquasec/tfsec /src
Use with Visual Studio Code
A Visual Studio Code extension is being developed to integrate with tfsec results. More information can be found on the tfsec Marketplace page
Use as GitHub Action
If you want to run tfsec on your repository as a GitHub Action, you can use https://github.com/aquasecurity/tfsec-pr-commenter-action.
Use as an Azure DevOps Pipelines Task
You can now install the official tfsec task. Please raise any issues/feature requests on the task repository.
Ignoring Warnings
You may wish to ignore some warnings. If you'd like to do so, you can
simply add a comment containing tfsec:ignore:<rule> to the offending
line in your templates. Alternatively, you can add the comment to the line above the block containing the issue, or to the module block to ignore all occurrences of an issue inside the module.
For example, to ignore an open security group rule:
resource "aws_security_group_rule" "my-rule" {
type = "ingress"
cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-ingress-sgr
}
...or...
resource "aws_security_group_rule" "my-rule" {
type = "ingress"
#tfsec:ignore:aws-vpc-no-public-ingress-sgr
cidr_blocks = ["0.0.0.0/0"]
}
If you're not sure which line to add the comment on, just check the tfsec output for the line number of the discovered problem.
You can ignore multiple rules by concatenating the rules on a single line:
#tfsec:ignore:aws-s3-enable-bucket-encryption tfsec:ignore:aws-s3-enable-bucket-logging
resource "aws_s3_bucket" "my-bucket" {
bucket = "foobar"
acl = "private"
}
Expiration Date
You can set expiration date for ignore with yyyy-mm-dd format. This is a useful feature when you want to ensure ignored issue won't be forgotten and should be revisited in the future.
#tfsec:ignore:aws-s3-enable-bucket-encryption:exp:2025-01-02
Ignore like this will be active only till 2025-01-02, after this date it will be deactivated.
Disable checks
You may wish to exclude some checks from running. If you'd like to do so, you can
simply add new argument -e check1,check2,etc to your cmd command
tfsec . -e general-secrets-sensitive-in-variable,google-compute-disk-encryption-customer-keys
Including values from .tfvars
You can include values from a tfvars file in the scan, using, for example: --tfvars-file terraform.tfvars.
Included Checks
tfsec supports many popular cloud and platform providers
| Checks |
|---|
| AWS Checks |
| Azure Checks |
| GCP Checks |
| CloudStack Checks |
| DigitalOcean Checks |
| GitHub Checks |
| Kubernetes Checks |
| OpenStack Checks |
| Oracle Checks |
Running in CI
tfsec is designed for running in a CI pipeline. You may wish to run tfsec as part of your build without coloured
output. You can do this using --no-colour (or --no-color for our American friends).
Output options
You can output tfsec results as JSON, CSV, Checkstyle, Sarif, JUnit or just plain old human-readable format. Use the --format flag
to specify your desired format.
GitHub Security Alerts
If you want to integrate with Github Security alerts and include the output of your tfsec checks you can use the tfsec-sarif-action Github action to run the static analysis then upload the results to the security alerts tab.
The alerts generated for tfsec-example-project look like this.
When you click through the alerts for the branch, you get more information about the actual issue.
For more information about adding security alerts, check the GitHub documentation
Support for older terraform versions
If you need to support versions of terraform which use HCL v1
(terraform <0.12), you can use v0.1.3 of tfsec, though support is
very limited and has fewer checks.
Contributing
We always welcome contributions; big or small, it can be documentation updates, adding new checks or something bigger. Please check the Contributing Guide for details on how to help out.
Some People who have contributed
Made with contributors-img.
tfsec is an Aqua Security open source project.
Learn about our open source work and portfolio here.
Join the community, and talk to us about any matter in GitHub Discussion or Slack.
Top Related Projects
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.
Linting tool for CloudFormation templates
Snyk CLI scans and monitors your projects for security vulnerabilities.
Protect and discover secrets using Gitleaks 🔑
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
Convert designs to code with AI
Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.
Try Visual Copilot