All Projects → tfsec → Tfsec

tfsec / Tfsec

Licence: mit
Security scanner for your Terraform code

Programming Languages

go
31211 projects - #10 most used programming language

Projects that are alternatives of or similar to Tfsec

Terraform Security Scan
Run a security scan on your terraform with the very nice https://github.com/liamg/tfsec
Stars: ✭ 64 (-98.23%)
Mutual labels:  aws, azure, google-cloud-platform, static-analysis, hacktoberfest, terraform, scanner, compliance, ci
Checkov
Prevent cloud misconfigurations during build-time for Terraform, Cloudformation, Kubernetes, Serverless framework and other infrastructure-as-code-languages with Checkov by Bridgecrew.
Stars: ✭ 3,572 (-1.38%)
Mutual labels:  aws, azure, static-analysis, hacktoberfest, terraform, infrastructure-as-code, compliance, devsecops
Terracognita
Reads from existing Cloud Providers (reverse Terraform) and generates your infrastructure as code on Terraform configuration
Stars: ✭ 452 (-87.52%)
Mutual labels:  aws, azure, google-cloud-platform, terraform, infrastructure-as-code
Cluster.dev
Kubernetes-based Dev Environments with GitOps
Stars: ✭ 122 (-96.63%)
Mutual labels:  aws, hacktoberfest, terraform, infrastructure-as-code, digitalocean
Horusec
Horusec is an open source tool that improves identification of vulnerabilities in your project with just one command.
Stars: ✭ 311 (-91.41%)
Mutual labels:  static-analysis, hacktoberfest, terraform, scanner, ci
Trivy
Scanner for vulnerabilities in container images, file systems, and Git repositories, as well as for configuration issues
Stars: ✭ 9,673 (+167.06%)
Mutual labels:  hacktoberfest, vulnerability-scanners, infrastructure-as-code, devsecops, misconfiguration
Typhoon
Minimal and free Kubernetes distribution with Terraform
Stars: ✭ 1,397 (-61.43%)
Mutual labels:  aws, azure, terraform, digitalocean
Engine
Deploy your apps on any Cloud provider in just a few seconds
Stars: ✭ 1,132 (-68.75%)
Mutual labels:  aws, azure, terraform, digitalocean
Terrascan
Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.
Stars: ✭ 2,687 (-25.81%)
Mutual labels:  aws, terraform, infrastructure-as-code, devsecops
intercept
INTERCEPT / Policy as Code Static Analysis Auditing / SAST
Stars: ✭ 54 (-98.51%)
Mutual labels:  scanner, static-analysis, compliance, devsecops
Iam Policy Json To Terraform
Small tool to convert an IAM Policy in JSON format into a Terraform aws_iam_policy_document
Stars: ✭ 282 (-92.21%)
Mutual labels:  aws, hacktoberfest, terraform, infrastructure-as-code
Infracost
Cloud cost estimates for Terraform in pull requests💰📉 Love your cloud bill!
Stars: ✭ 4,505 (+24.38%)
Mutual labels:  aws, terraform, infrastructure-as-code, azure
Terraform Aws Gitlab Runner
Terraform module for AWS GitLab runners on ec2 (spot) instances
Stars: ✭ 292 (-91.94%)
Mutual labels:  aws, terraform, infrastructure-as-code, ci
Terraform Provider Digitalocean
Terraform DigitalOcean provider
Stars: ✭ 296 (-91.83%)
Mutual labels:  hacktoberfest, terraform, infrastructure-as-code, digitalocean
Terratag
Terratag is a CLI tool that enables users of Terraform to automatically create and maintain tags across their entire set of AWS, Azure, and GCP resources
Stars: ✭ 385 (-89.37%)
Mutual labels:  aws, azure, terraform, infrastructure-as-code
Drone Cache
A Drone plugin for caching current workspace files between builds to reduce your build times
Stars: ✭ 194 (-94.64%)
Mutual labels:  aws, azure, hacktoberfest
Cloudquery
cloudquery transforms your cloud infrastructure into SQL or Graph database for easy monitoring, governance and security.
Stars: ✭ 1,300 (-64.11%)
Mutual labels:  aws, azure, compliance
Buildpipeline
AWS-powered serverless build, test and deploy pipeline ft. multiple environments
Stars: ✭ 105 (-97.1%)
Mutual labels:  aws, terraform, ci
Toc
A Table of Contents of all Gruntwork Code
Stars: ✭ 111 (-96.94%)
Mutual labels:  aws, terraform, infrastructure-as-code
Terraboard
🌍 📋 A web dashboard to inspect Terraform States
Stars: ✭ 1,192 (-67.09%)
Mutual labels:  aws, terraform, infrastructure-as-code

GoReportCard Join Our Slack Docker Build Homebrew Chocolatey AUR version VScode Extension

tfsec uses static analysis of your terraform templates to spot potential security issues. Now with terraform CDK support.

Aqua and tfsec

Great news - tfsec has now joined Aqua Security. Not only will the project remain open source, it now has a lot more resource and expertise behind it. Expect great new features and many more checks very soon...

Example Output

Example screenshot

Installation

Install with brew/linuxbrew

brew install tfsec

Install with Chocolatey

choco install tfsec

Install with Scoop

scoop install tfsec

You can also grab the binary for your system from the releases page.

Alternatively, install with Go:

go install github.com/aquasecurity/tfsec/cmd/tfsec@latest

Please note that using go install will install directly from the master branch and version numbers will not be reported via tfsec --version.

Signing

The binaries on the releases page are signed with the tfsec signing key D66B222A3EA4C25D5D1A097FC34ACEFB46EC39CE

Form more information check the signing page for instructions on verification.

Usage

tfsec will scan the specified directory. If no directory is specified, the current working directory will be used.

The exit status will be non-zero if tfsec finds problems, otherwise the exit status will be zero.

tfsec .

Use with Docker

As an alternative to installing and running tfsec on your system, you may run tfsec in a Docker container.

There are a number of Docker options available

Image Name Base Comment
aquasec/tfsec alpine Normal tfsec image
aquasec/tfsec-alpine alpine Exactly the same as aquasec/tfsec, but for those whole like to be explicit
aquasec/tfsec-ci alpine tfsec with no entrypoint - useful for CI builds where you want to override the command
aquasec/tfsec-scratch scratch An image built on scratch - nothing frilly, just runs tfsec

To run:

docker run --rm -it -v "$(pwd):/src" aquasec/tfsec /src

Use with Visual Studio Code

A Visual Studio Code extension is being developed to integrate with tfsec results. More information can be found on the tfsec Marketplace page

Use as GitHub Action

If you want to run tfsec on your repository as a GitHub Action, you can use https://github.com/aquasecurity/tfsec-pr-commenter-action.

Features

  • Checks for sensitive data inclusion across all providers
  • Checks for violations of best practice recommendations across all major cloud providers
  • Scans modules (currently only local modules are supported)
  • Evaluates expressions as well as literal values
  • Evaluates Terraform functions e.g. concat()

Ignoring Warnings

You may wish to ignore some warnings. If you'd like to do so, you can simply add a comment containing tfsec:ignore:<rule> to the offending line in your templates. If the problem refers to a block of code, such as a multiline string, you can add the comment on the line above the block, by itself.

For example, to ignore an open security group rule:

resource "aws_security_group_rule" "my-rule" {
    type = "ingress"
    cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-ingress-sgr
}

...or...

resource "aws_security_group_rule" "my-rule" {
    type = "ingress"
    #tfsec:ignore:aws-vpc-no-public-ingress-sgr
    cidr_blocks = ["0.0.0.0/0"]
}

If you're not sure which line to add the comment on, just check the tfsec output for the line number of the discovered problem.

You can ignore multiple rules by concatenating the rules on a single line:

#tfsec:ignore:aws-s3-enable-bucket-encryption tfsec:ignore:aws-s3-enable-bucket-logging
resource "aws_s3_bucket" "my-bucket" {
  bucket = "foobar"
  acl    = "private"
}

Expiration Date

You can set expiration date for ignore with yyyy-mm-dd format. This is a useful feature when you want to ensure ignored issue won't be forgotten and should be revisited in the future.

#tfsec:ignore:aws-s3-enable-bucket-encryption:exp:2022-01-02

Ignore like this will be active only till 2022-01-02, after this date it will be deactivated.

Recent Ignore Changes

As of v0.52.0, we fixed an issue where ignores were being incorrectly applied to entire blocks. This has made it more important that ignore comments are added to the correct line(s) in your templates. If tfsec mentions a particular line number as containing an issue you want to ignore, you should add the comment on that same line, or by itself on the line above it (or above the entire block to ignore all issues of that type in the block). If tfsec mentions an entire block as being the issue, you should add a comment on the line above the first line of the block.

Disable checks

You may wish to exclude some checks from running. If you'd like to do so, you can simply add new argument -e check1,check2,etc to your cmd command

tfsec . -e general-secrets-sensitive-in-variable,google-compute-disk-encryption-customer-keys

Including values from .tfvars

You can include values from a tfvars file in the scan, using, for example: --tfvars-file terraform.tfvars.

Included Checks

Checks are currently limited to AWS/Azure/GCP resources, but there are also checks which are provider agnostic.

Checks
AWS Checks
Azure Checks
GCP Checks
General Checks

Running in CI

tfsec is designed for running in a CI pipeline. You may wish to run tfsec as part of your build without coloured output. You can do this using --no-colour (or --no-color for our American friends).

Output options

You can output tfsec results as JSON, CSV, Checkstyle, Sarif, JUnit or just plain old human readable format. Use the --format flag to specify your desired format.

Github Security Alerts

If you want to integrate with Github Security alerts and include the output of your tfsec checks you can use the tfsec-sarif-action Github action to run the static analysis then upload the results to the security alerts tab.

The alerts generated for tfsec-example-project look like this.

github security alerts

When you click through the alerts for the branch, you get more information about the actual issue.

github security alerts

For more information about adding security alerts, check

Support for older terraform versions

If you need to support versions of terraform which use HCL v1 (terraform <0.12), you can use v0.1.3 of tfsec, though support is very limited and has fewer checks.

Contributing

We always welcome contributions; big or small, it can be documentation updates, adding new checks or something bigger. Please check the Contributing Guide for details on how to help out.

Some People who have contributed

Made with contributors-img.

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].