Static Analysis (Security scanner) for Terraform Code

Using TFsec tool

What is Terraform?

Basically, we use terraform tool to provision cloud services from CLI using the code.

But can we check if our terrafrom code has some security flaws??

YES. We can. Using TFsec tool.

TFsec uses HCL parser to understand the terraform code and have many default checks in place already. They also give you freedom to write your own custom checks.

You can run this tool in you CI pipeline (also in github actions) and check your code before making changes to cloud. And the best thing it is supported in all the mostly used OS.. and they have a docker container as well (which I love btw).

You can download yourself one form here →

And they are also Open Source. That means you can read the code and make changes to it that suits you best. And also you can help to make it better. Just like tons of people who are making it better everyday.

“Gettign Hands Dirty” Time

variable file with default secret key

I am now expecting any security scanner to detect this type of behavior and report it.

After the code was ready… I pulled and created a container for tfsec and mounted my code repository in that to perform scanning.

docker run --rm -it -v $PWD:/src tfsec/tfsec /src

And as expected,

scan report from tfsec

It gave me a good human readable report with all the highlighted potential issues along with the time taken for everything. Since it is using HCL parser to parse every thing.. It also gives me warning/errors in my code.


Connecting the dots and rest is magic.