tfsec — Static Security Scanner for Terraform Code

What it is

tfsec is a static analysis security scanner for Terraform HCL files. It checks for hundreds of built-in security rules covering AWS, Azure, and GCP resources. It runs with zero configuration and flags issues like unencrypted storage, overly permissive IAM policies, and missing logging before you deploy.

It targets Terraform users and DevOps teams who want fast, automated security checks integrated into their development workflow and CI pipelines.

How it saves time or tokens

tfsec runs in seconds against your Terraform codebase and provides clear, actionable output. Each finding includes the rule ID, severity, affected resource, and a link to documentation explaining the fix. No cloud credentials or deployed infrastructure needed.

How to use

1. Install tfsec:

brew install tfsec
# Or via Go:
go install github.com/aquasecurity/tfsec/cmd/tfsec@latest

1. Scan your Terraform directory:

tfsec ./terraform

1. Review findings and fix flagged resources.

Example

# Install
brew install tfsec

# Scan current directory
tfsec .

# Scan specific directory with severity filter
tfsec ./infra --minimum-severity HIGH

# Output as JSON for CI
tfsec ./infra -f json

# Exclude specific rules
tfsec . --exclude aws-s3-enable-versioning

Related on TokRepo

• AI Tools for Security — Security scanning and compliance tools
• AI Tools for DevOps — Infrastructure automation and DevOps tools

Key considerations

When evaluating tfsec for your workflow, consider the following factors. First, assess whether your team has the technical prerequisites to adopt this tool effectively. Second, evaluate the maintenance burden against the productivity gains. Third, check community activity and documentation quality to ensure long-term viability. Integration with your existing toolchain matters more than feature count alone. Start with a small pilot project before rolling out across the organization. Monitor resource usage during the initial adoption phase to identify bottlenecks early. Document your configuration decisions so team members can onboard independently.

Common pitfalls

• tfsec has been absorbed into Trivy by Aqua Security; new users should consider using Trivy's Terraform scanning instead.
• Variable values from tfvars files are not always resolved; some findings may be false positives for dynamically set values.
• Custom modules with complex variable passing may not be fully analyzed; run tfsec at the module level for better coverage.