aquasecurity/tfsec

Features

• Infrastructure as Code Security - Provides automated security scanning and misconfiguration detection for infrastructure-as-code configuration files.
• Static Analysis Engines - Analyzes infrastructure code by parsing resource blocks and attributes to identify security vulnerabilities and misconfigurations.
• Terraform Analyzers - Performs static analysis specifically on Terraform configuration files to identify security misconfigurations.
• Misconfiguration Detectors - Identifies insecure settings such as public access or unencrypted storage within cloud compute and networking definitions.
• Unified Resource Models - Maps diverse cloud resource definitions from different providers into a unified format for consistent security scanning.
• Configuration Expression Resolvers - Resolves complex functional expressions to evaluate actual security settings instead of relying on literal strings.
• Infrastructure as Code Scanners - Analyzes infrastructure templates to identify insecure settings before they are deployed to production.
• JSON-Based Rule Engines - Evaluates resource configurations against security benchmarks using a predefined set of rules.
• Misconfiguration Scanning - Detects known security flaws and structural misconfigurations across cloud infrastructure definitions.
• Policy Enforcement Engines - Evaluates infrastructure configurations against defined security and compliance rules to enforce standards.
• Cloud Security Posture Scanners - Evaluates cloud configurations against established security benchmarks to detect risks and misconfigurations.
• Static Expression Evaluation - Resolves functional expressions and resource relationships to detect misconfigurations beyond literal string values.
• Google Cloud Resource Audits - Detects security misconfigurations across identity, networking, storage, and compute resources in Google Cloud.
• CI/CD Pipeline Integrations - Automates security checks within CI/CD pipelines as a standalone binary or container.
• Cloud Auditing Tools - Audits infrastructure templates across AWS, Azure, and GCP to identify common security gaps.
• Infrastructure Policy Definition - Enforces organization-specific infrastructure standards through tailored security checks defined in configuration files.
• Azure Misconfiguration Detectors - Identifies security vulnerabilities across compute, networking, and storage services by scanning Azure infrastructure code.
• GitHub Configuration Audits - Identifies security misconfigurations in GitHub repository settings, branch protections, and automation workflows.
• DigitalOcean Configuration Audits - Analyzes DigitalOcean compute and storage configurations for security misconfigurations.
• AWS - Performs automated security checks of Amazon Web Services resource settings and access controls.
• Kubernetes Posture Scanning - Analyzes Kubernetes service definitions to detect insecure network settings and misconfigurations.
• Workflow Automation - Static analysis for security.
• Workflow Utilities - Static analysis tool for security misconfigurations.

Star history