Tfsec is a static analysis scanner for Terraform infrastructure-as-code that detects security misconfigurations across cloud providers.
Tfsec addresses the problem of identifying security risks in Terraform configurations before deployment. It uses static analysis to examine HCL code and spot potential misconfigurations. The tool evaluates both literal values and HCL expressions, including Terraform functions like concat(), and can trace relationships between resources. It applies hundreds of built-in rules covering major cloud providers and supports user-defined Rego policies for custom checks. The scanner handles local and remote modules and is compatible with Terraform CDK.
Tfsec suits teams using Terraform who want to integrate security scanning into CI pipelines. It offers multiple output formats including JSON, SARIF, CSV, CheckStyle, JUnit, and text, making it adaptable to different workflows. IDE plugins are available for JetBrains, VSCode, and Vim. The tool is fast and capable of scanning large repositories quickly. However, the project has transitioned to Trivy, which consolidates tfsec's Terraform scanning capabilities alongside support for additional languages and a broader ecosystem of integrations. While tfsec remains available, the maintainers direct engineering effort toward Trivy going forward.
The project maintains the tfsec repository as a stable tool while actively developing its successor. Development focus has shifted away from tfsec toward Trivy, where Terraform scanning continues as a native capability alongside expanded functionality for other infrastructure-as-code languages.
