tfsec uses static analysis of your terraform templates to spot potential security issues. Now with terraform v0.12+ support.

Grab the binary for your system from the releases page.

Alternatively, install with Go:

env GO111MODULE=on go get -u github.com/liamg/tfsec/cmd/tfsec

tfsec will recursively scan the specified directory. If no directory is specified, the current working directory will be used.

The exit status will be non zero if problems are found, otherwise the exit status will be zero.

tfsec .

• Checks for sensitive data inclusion across all providers
• Checks for violations of AWS, Azure and GCP security best practice recommendations
• Scans modules (currently only local modules are supported)
• Evaluates expressions as well as literal values

You may wish to ignore some warnings. If you'd like to do so, you can simply add a comment containing tfsec:ignore:<CODE> to the offending line in your templates. If the problem refers to a block of code, such as a multiline string, you can add the comment on the line above the block, by itself.

For example, to ignore an open security group rule:

resource "aws_security_group_rule" "my-rule" {
    type = "ingress"
    cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:AWS006
}

...or...

resource "aws_security_group_rule" "my-rule" {
    type = "ingress"
    #tfsec:ignore:AWS006
    cidr_blocks = ["0.0.0.0/0"] 
}

If you're not sure which line to add the comment on, just check the tfsec output for the line number of the discovered problem.

Currently, checks are mostly limited to AWS/Azure/GCP resources, but there are also checks which are provider agnostic.

tfsec is designed for running in a CI pipeline. For this reason it will exit with a non-zero exit code if a potential problem is detected. You may wish to run tfsec as part of your build without coloured output. You can do this using --no-colour (or --no-color for our American friends).

If you need to support versions of terraform which use HCL v1 (terraform <0.12), you can use v0.1.3 of tfsec, though support is very limited and has fewer checks.