[opensourcedex]

tfsec is a free, open source compliance & risk management project written in Go and released under MIT. It has 7,038 GitHub stars, 558 forks and 18 open issues, and was last pushed 6 months ago. On this registry it ranks #11 of 45 tracked projects in Compliance & Risk Management, with 5 head-to-head comparisons available. It gained 2 stars over the last 3 tracked days.

What is tfsec?

What it is

tfsec is a static analysis security scanner for Terraform code, written in Go and released under the MIT license. It lives in the infrastructure-as-code and DevSecOps ecosystem, alongside tools such as linters and CI scanners. The project is now part of Trivy, Aqua Security's broader open source security scanner, and its Terraform scanning engine forms the foundation of Trivy's IaC and misconfiguration scanning capabilities. The repository remains available, but engineering attention is directed at Trivy going forward.

The concrete problem tfsec solves is catching security misconfigurations in Terraform before infrastructure is deployed. It reads Terraform HCL, evaluates expressions, functions, and relationships between resources, and flags potential risks across all major cloud providers plus some minor ones. This gives teams a way to enforce security checks inside a CI pipeline rather than discovering problems after provisioning.

Key capabilities

  • Checks for misconfigurations across all major cloud providers and some minor ones.
  • Ships with hundreds of built-in rules.
  • Scans modules, both local and remote.
  • Evaluates HCL expressions as well as literal values, including Terraform functions such as concat().
  • Evaluates relationships between Terraform resources.
  • Compatible with the Terraform CDK.
  • Applies and embellishes user-defined Rego policies.
  • Supports multiple output formats: lovely (default), JSON, SARIF, CSV, CheckStyle, JUnit, text, and Gif.
  • Configurable via CLI flags and/or a config file.
  • Provides plugins for JetBrains, VSCode, and Vim.

Who uses it and how

  • Teams integrate tfsec into CI pipelines to scan Terraform on every change.
  • Terraform projects use it as a default static analysis tool to detect security risks, a use case Thoughtworks rated Adopt on its Tech Radar.
  • Developers run it from IDE plugins for JetBrains, VSCode, and Vim to see findings while editing.
  • Users scan large repositories quickly, since the tool is built for speed.
  • Organizations extend it with custom Rego policies to match internal rules.

Getting started

Install with Homebrew (brew install tfsec), Chocolatey (choco install tfsec), Scoop (scoop install tfsec), or the AUR package tfsec-bin. A Docker image is published as tfsec/tfsec, and a VSCode extension is available on the marketplace.

When to use it — and when not to

tfsec remains a capable Terraform scanner, but it is now in maintenance mode as the project consolidates into Trivy, so new users should weigh migrating to Trivy for continued

project readme (upstream, from github) — read inline

GoReportCard Join Our Slack Docker Build Homebrew Chocolatey AUR version VScode Extension

📣 tfsec to Trivy Migration

As part of our goal to provide a comprehensive open source security solution for all, we have been consolidating all of our scanning-related efforts in one place, and that is Trivy.

Over the past year, tfsec has laid the foundations to Trivy's IaC & misconfigurations scanning capabilities, including Terraform scanning, which has been natively supported in Trivy for a long time now.

Going forward we want to encourage the tfsec community to transition over to Trivy. Moving to Trivy gives you the same excellent Terraform scanning engine, with some extra benefits:

  1. Access to more languages and features in the same tool.
  2. Access to more integrations with tools and services through the rich ecosystem around Trivy.
  3. Commercially supported by Aqua as well as by a the passionate Trivy community. tfsec will continue to remain available for the time being, although our engineering attention will be directed at Trivy going forward.

tfsec to Trivy migration guide

For further information on how Trivy compares to tfsec and moving from tfsec to Trivy, do have a look at the migration guide.

Overview

tfsec uses static analysis of your terraform code to spot potential misconfigurations.

Features

  • :cloud: Checks for misconfigurations across all major (and some minor) cloud providers
  • :no_entry: Hundreds of built-in rules
  • :nesting_dolls: Scans modules (local and remote)
  • :heavy_plus_sign: Evaluates HCL expressions as well as literal values
  • :arrow_right_hook: Evaluates Terraform functions e.g. concat()
  • :link: Evaluates relationships between Terraform resources
  • :toolbox: Compatible with the Terraform CDK
  • :no_good: Applies (and embellishes) user-defined Rego policies
  • :page_with_curl: Supports multiple output formats: lovely (default), JSON, SARIF, CSV, CheckStyle, JUnit, text, Gif.
  • :hammer_and_wrench: Configurable (via CLI flags and/or config file)
  • :zap: Very fast, capable of quickly scanning huge repositories
  • :electric_plug: Plugins for popular IDEs available (JetBrains, VSCode and Vim)
  • :house_with_garden: Community-driven - come and chat with us on Slack!

Recommended by Thoughtworks

Rated Adopt by the Thoughtworks Tech Radar:

For our projects using Terraform, tfsec has quickly become a default static analysis tool to detect potential security risks. It's easy to integrate into a CI pipeline and has a growing library of checks against all of the major cloud providers and platforms like Kubernetes. Given its ease of use, we believe tfsec could be a good addition to any Terraform project.

Example Output

Example screenshot

Installation

Install with brew/linuxbrew

brew install tfsec

Install with Chocolatey

choco install tfsec

Install with Scoop

scoop install tfsec

Bash script (Linux):

curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash

You can also grab the binary for your system from the releases page.

Alternatively, install with Go:

go install github.com/aquasecurity/tfsec/cmd/tfsec@latest

Please note that using go install will install directly from the master branch and version numbers will not be reported via tfsec --version.

Signing

The binaries on the releases page are signed with the tfsec signing key D66B222A3EA4C25D5D1A097FC34ACEFB46EC39CE

Form more information check the signing page for instructions on verification.

Usage

tfsec will scan the specified directory. If no directory is specified, the current working directory will be used.

The exit status will be non-zero if tfsec finds problems, otherwise the exit status will be zero.

tfsec .

Use with Docker

As an alternative to installing and running tfsec on your system, you may run tfsec in a Docker container.

There are a number of Docker options available

Image Name Base Comment
aquasec/tfsec alpine Normal tfsec image
aquasec/tfsec-alpine alpine Exactly the same as aquasec/tfsec, but for those whole like to be explicit
aquasec/tfsec-ci alpine tfsec with no entrypoint - useful for CI builds where you want to override the command
aquasec/tfsec-scratch scratch An image built on scratch - nothing frilly, just runs tfsec

To run:

docker run --rm -it -v "$(pwd):/src" aquasec/tfsec /src

Use with Visual Studio Code

A Visual Studio Code extension is being developed to integrate with tfsec results. More information can be found on the tfsec Marketplace page

Use as GitHub Action

If you want to run tfsec on your repository as a GitHub Action, you can use https://github.com/aquasecurity/tfsec-pr-commenter-action.

Use as an Azure DevOps Pipelines Task

You can now install the official tfsec task. Please raise any issues/feature requests on the task repository.

Ignoring Warnings

You may wish to ignore some warnings. If you'd like to do so, you can simply add a comment containing tfsec:ignore: to the offending line in your templates. Alternatively, you can add the comment to the line above the block containing the issue, or to the module block to ignore all occurrences of an issue inside the module.

For example, to ignore an open security group rule:

resource "aws_security_group_rule" "my-rule" {
    type = "ingress"
    cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-ingress-sgr
}

...or...

resource "aws_security_group_rule" "my-rule" {
    type = "ingress"
    #tfsec:ignore:aws-vpc-no-public-ingress-sgr
    cidr_blocks = ["0.0.0.0/0"]
}

If you're not sure which line to add the comment on, just check the tfsec output for the line number of the discovered problem.

You can ignore multiple rules by concatenating the rules on a single line:

#tfsec:ignore:aws-s3-enable-bucket-encryption tfsec:ignore:aws-s3-enable-bucket-logging
resource "aws_s3_bucket" "my-bucket" {
  bucket = "foobar"
  acl    = "private"
}

Expiration Date

You can set expiration date for ignore with yyyy-mm-dd format. This is a useful feature when you want to ensure ignored issue won't be forgotten and should be revisited in the future.

#tfsec:ignore:aws-s3-enable-bucket-encryption:exp:2025-01-02

Ignore like this will be active only till 2025-01-02, after this date it will be deactivated.

Disable checks

You may wish to exclude some checks from running. If you'd like to do so, you can simply add new argument -e check1,check2,etc to your cmd command

tfsec . -e general-secrets-sensitive-in-variable,google-compute-disk-encryption-customer-keys

Including values from .tfvars

You can include values from a tfvars file in the scan, using, for example: --tfvars-file terraform.tfvars.

Included Checks

tfsec supports many popular cloud and platform providers

| Checks

readme truncated — read the full docs on github

Frequently asked questions

Is tfsec free to use?

tfsec is open source under the MIT licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does tfsec do?

Tfsec is now part of Trivy

What is tfsec written in?

tfsec is primarily written in Go. Its source is publicly available at https://github.com/aquasecurity/tfsec, and it has 7,038 GitHub stars.