liamg/tfsec
Tfsec
tfsec is a static analysis tool and security scanner for Terraform configuration files. It functions as an infrastructure as code security scanner and compliance linter designed to detect misconfigurations and vulnerabilities across multiple cloud providers before resources are deployed.
The tool identifies security risks by analyzing infrastructure code and variable files to evaluate the final state of the environment. It supports custom policy enforcement and allows for the suppression of specific security warnings through inline comments.
Its capabilities cover cloud security posture management, infrastructure as code compliance, and integration into DevSecOps pipelines. The system also provides scan result export and security alert synchronization for centralized vulnerability management.
Features
- Infrastructure as Code Scanners - Analyzes infrastructure templates and configuration files to detect security vulnerabilities and compliance issues before deployment.
- Static Analysis Engines - Functions as a static analysis engine that scans source code for security vulnerabilities without execution.
- Compliance Linters - Provides policy enforcement to ensure infrastructure code adheres to security best practices and organizational standards.
- Terraform Analyzers - Analyzes Terraform configuration files to detect misconfigurations and vulnerabilities using static analysis.
- HCL Configuration Parsing - Implements a core parsing engine to convert HCL configuration files into an abstract syntax tree.
- Infrastructure as Code Security - Performs automated security scanning of infrastructure configuration files to ensure compliance.
- Misconfiguration Scanning - Evaluates Terraform configuration files against security benchmarks to identify structural misconfigurations.
- Cloud Security Posture Scanners - Provides a scanning engine to detect misconfigurations and security risks across cloud infrastructure assets.
- Security Pattern Matching - Matches infrastructure code structures against known signatures of security vulnerabilities.
- Configuration Logic Evaluators - Provides logic evaluation to identify security vulnerabilities within infrastructure resource settings.
- Infrastructure Variable Resolution - Resolves variable references within infrastructure code to determine the final state of resource attributes.
- External Environment File Loaders - Imports environment variables from external files to accurately evaluate the infrastructure's final state.
- CI/CD Pipeline Integrations - Offers native support for automating security checks within CI/CD pipeline workflows.
- Expression Evaluators - Evaluates complex mathematical and logical expressions within infrastructure code to detect non-literal security risks.
- Infrastructure Policy Enforcement - Applies custom compliance and security policies to infrastructure configurations as code.
- Infrastructure as Code Analysis - Scans Terraform templates for security misconfigurations.
- Infrastructure Security - Static analysis to identify security issues in Terraform.
