{"id":13490890,"url":"https://github.com/aquasecurity/tfsec","last_synced_at":"2025-05-16T01:02:53.835Z","repository":{"id":37082112,"uuid":"173785481","full_name":"aquasecurity/tfsec","owner":"aquasecurity","description":"Tfsec is now part of Trivy","archived":false,"fork":false,"pushed_at":"2025-05-02T04:22:26.000Z","size":121766,"stargazers_count":6813,"open_issues_count":14,"forks_count":547,"subscribers_count":68,"default_branch":"master","last_synced_at":"2025-05-09T00:55:05.086Z","etag":null,"topics":["aws","azure","ci","compliance","devops","devsecops","digitalocean","go","google-cloud-platform","hacktoberfest","infrastructure-as-code","linter","misconfiguration","scanner","security","static-analysis","terraform","terraform-security","vulnerability-scanners"],"latest_commit_sha":null,"homepage":"https://aquasecurity.github.io/trivy/","language":"Go","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/aquasecurity.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2019-03-04T16:56:59.000Z","updated_at":"2025-05-08T04:06:06.000Z","dependencies_parsed_at":"2023-12-31T11:41:31.787Z","dependency_job_id":"09f4cfe8-c498-4a96-86b8-21188b2aad5d","html_url":"https://github.com/aquasecurity/tfsec","commit_stats":{"total_commits":1184,"total_committers":127,"mean_commits":9.32283464566929,"dds":0.816722972972973,"last_synced_commit":"e24d85950927915bba8d8cfdc7776baf07f781c7"},"previous_names":["tfsec/tfsec","liamg/tfsec"],"tags_count":341,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aquasecurity%2Ftfsec","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aquasecurity%2Ftfsec/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aquasecurity%2Ftfsec/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aquasecurity%2Ftfsec/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/aquasecurity","download_url":"https://codeload.github.com/aquasecurity/tfsec/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254448578,"owners_count":22072764,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","azure","ci","compliance","devops","devsecops","digitalocean","go","google-cloud-platform","hacktoberfest","infrastructure-as-code","linter","misconfiguration","scanner","security","static-analysis","terraform","terraform-security","vulnerability-scanners"],"created_at":"2024-07-31T19:00:51.835Z","updated_at":"2025-05-16T01:02:53.802Z","avatar_url":"https://github.com/aquasecurity.png","language":"Go","funding_links":[],"categories":["Go","Infrastructure as code security","tfssec","Infrastructure as Code","Other Awesome Lists","Infrastructure Security","Tools","Static Application Security Testing","📚 Learning Resources","Security","蓝队工具","terraform","Repositories","azure","go","aws","Companion Tools","Tooling— Security and Policies","Infrastructure as Code Security"],"sub_categories":["Terraform Tooling","Terraform","Infrastructure as Code (IaC) Security","Community providers","Infrastructure as Code Security","IAC(Infrastructure-as-Code)扫描","Infrastructure as Code Scanning","Kubernetes Audit","Language Specific"],"readme":"\u003cp align=\"center\"\u003e\n  \u003cimg width=\"354\" src=\".github/images/tfsec_worded.png\"\u003e\n\u003c/p\u003e\n\n[![GoReportCard](https://goreportcard.com/badge/github.com/aquasecurity/tfsec)](https://goreportcard.com/report/github.com/aquasecurity/tfsec)\n[![Join Our Slack](https://img.shields.io/badge/Slack-Join-green)](https://slack.aquasec.com/)\n[![Docker Build](https://img.shields.io/docker/v/tfsec/tfsec?label=docker)](https://hub.docker.com/r/tfsec/tfsec)\n[![Homebrew](https://img.shields.io/badge/dynamic/json.svg?url=https://formulae.brew.sh/api/formula/tfsec.json\u0026query=$.versions.stable\u0026label=homebrew)](https://formulae.brew.sh/formula/tfsec)\n[![Chocolatey](https://img.shields.io/chocolatey/v/tfsec)](https://chocolatey.org/packages/tfsec)\n[![AUR version](https://img.shields.io/aur/version/tfsec-bin)](https://aur.archlinux.org/packages/tfsec-bin)\n[![VScode Extension](https://img.shields.io/visual-studio-marketplace/v/tfsec.tfsec?label=vscode)](https://marketplace.visualstudio.com/items?itemName=tfsec.tfsec)\n\n## 📣 tfsec to Trivy Migration\n\nAs part of our goal to provide a comprehensive open source security solution for all, we have been consolidating all of our scanning-related efforts in one place, and that is [Trivy](https://github.com/aquasecurity/trivy). \n\nOver the past year, tfsec has laid the foundations to Trivy's IaC \u0026 misconfigurations scanning capabilities, including Terraform scanning, which has been natively supported in Trivy for a long time now.\n\nGoing forward we want to encourage the tfsec community to transition over to Trivy. Moving to Trivy gives you the same excellent Terraform scanning engine, with some extra benefits:\n\n1. Access to more languages and features in the same tool.\n2. Access to more integrations with tools and services through the rich ecosystem around Trivy.\n3. Commercially supported by Aqua as well as by a the passionate Trivy community.\ntfsec will continue to remain available for the time being, although our engineering attention will be directed at Trivy going forward.\n\n## tfsec to Trivy migration guide\n\nFor further information on how Trivy compares to tfsec and moving from tfsec to Trivy, do have a look at the [migration guide.](https://github.com/aquasecurity/tfsec/blob/master/tfsec-to-trivy-migration-guide.md)\n\n## Overview\ntfsec uses static analysis of your terraform code to spot potential misconfigurations.\n\n### Features\n\n- :cloud: Checks for misconfigurations across all major (and some minor) cloud providers\n- :no_entry: Hundreds of built-in rules\n- :nesting_dolls: Scans modules (local and remote)\n- :heavy_plus_sign: Evaluates HCL expressions as well as literal values\n- :arrow_right_hook: Evaluates Terraform functions e.g. `concat()`\n- :link: Evaluates relationships between Terraform resources\n- :toolbox: Compatible with the Terraform CDK\n- :no_good: Applies (and embellishes) user-defined Rego policies\n- :page_with_curl: Supports multiple output formats: lovely (default), JSON, SARIF, CSV, CheckStyle, JUnit, text, Gif.\n- :hammer_and_wrench: Configurable (via CLI flags and/or config file)\n- :zap: Very fast, capable of quickly scanning huge repositories\n- :electric_plug: Plugins for popular IDEs available ([JetBrains](https://plugins.jetbrains.com/plugin/18687-tfsec-findings-explorer), [VSCode](https://marketplace.visualstudio.com/items?itemName=tfsec.tfsec) and [Vim](https://github.com/aquasecurity/vim-tfsec))\n- :house_with_garden: Community-driven - come and chat with us [on Slack](https://slack.aquasec.com/)!\n\n## Recommended by Thoughtworks\n\nRated _Adopt_ by the [Thoughtworks Tech Radar](https://www.thoughtworks.com/en-gb/radar/tools/tfsec):\n\n\u003e For our projects using Terraform, tfsec has quickly become a default static analysis tool to detect potential security risks. It's easy to integrate into a CI pipeline and has a growing library of checks against all of the major cloud providers and platforms like Kubernetes. Given its ease of use, we believe tfsec could be a good addition to any Terraform project.\n\n## Example Output\n\n![Example screenshot](screenshot.png)\n\n## Installation\n\nInstall with [brew/linuxbrew](https://brew.sh)\n\n```bash\nbrew install tfsec\n```\n\nInstall with [Chocolatey](https://chocolatey.org/)\n\n```cmd\nchoco install tfsec\n```\n\nInstall with [Scoop](https://scoop.sh/)\n\n```cmd\nscoop install tfsec\n```\nBash script (Linux):\n\n```console\ncurl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash\n```\n\nYou can also grab the binary for your system from the [releases page](https://github.com/aquasecurity/tfsec/releases).\n\nAlternatively, install with Go:\n\n```bash\ngo install github.com/aquasecurity/tfsec/cmd/tfsec@latest\n```\n\nPlease note that using `go install` will install directly from the `master` branch and version numbers will not be reported via `tfsec --version`.\n\n### Signing\n\nThe binaries on the [releases page](https://github.com/aquasecurity/tfsec/releases) are signed with the tfsec signing key `D66B222A3EA4C25D5D1A097FC34ACEFB46EC39CE`\n\nForm more information check the [signing page](SIGNING.md) for instructions on verification.\n\n## Usage\n\ntfsec will scan the specified directory. If no directory is specified, the current working directory will be used.\n\nThe exit status will be non-zero if tfsec finds problems, otherwise the exit status will be zero.\n\n```bash\ntfsec .\n```\n\n## Use with Docker\n\nAs an alternative to installing and running tfsec on your system, you may run tfsec in a Docker container.\n\nThere are a number of Docker options available\n\n| Image Name | Base | Comment |\n|------------|------|---------|\n|[aquasec/tfsec](https://hub.docker.com/r/aquasec/tfsec)|alpine|Normal tfsec image|\n|[aquasec/tfsec-alpine](https://hub.docker.com/r/aquasec/tfsec-alpine)|alpine|Exactly the same as aquasec/tfsec, but for those whole like to be explicit|\n|[aquasec/tfsec-ci](https://hub.docker.com/r/aquasec/tfsec-ci)|alpine|tfsec with no entrypoint - useful for CI builds where you want to override the command|\n|[aquasec/tfsec-scratch](https://hub.docker.com/r/aquasec/tfsec-scratch)|scratch|An image built on scratch - nothing frilly, just runs tfsec|\n\nTo run:\n\n```bash\ndocker run --rm -it -v \"$(pwd):/src\" aquasec/tfsec /src\n```\n\n## Use with Visual Studio Code\n\nA Visual Studio Code extension is being developed to integrate with tfsec results. More information can be found on the [tfsec Marketplace page](https://marketplace.visualstudio.com/items?itemName=tfsec.tfsec)\n\n## Use as GitHub Action\n\nIf you want to run tfsec on your repository as a GitHub Action, you can use [https://github.com/aquasecurity/tfsec-pr-commenter-action](https://github.com/aquasecurity/tfsec-pr-commenter-action).\n\n## Use as an Azure DevOps Pipelines Task\n\nYou can now install the [official tfsec task](https://marketplace.visualstudio.com/items?itemName=AquaSecurityOfficial.tfsec-official). Please raise any issues/feature requests on the [task repository](https://github.com/aquasecurity/tfsec-azure-pipelines-task).\n\n## Ignoring Warnings\n\nYou may wish to ignore some warnings. If you'd like to do so, you can\nsimply add a comment containing `tfsec:ignore:\u003crule\u003e` to the offending\nline in your templates. Alternatively, you can add the comment to the line above the block containing the issue, or to the module block to ignore all occurrences of an issue inside the module.\n\nFor example, to ignore an open security group rule:\n\n```terraform\nresource \"aws_security_group_rule\" \"my-rule\" {\n    type = \"ingress\"\n    cidr_blocks = [\"0.0.0.0/0\"] #tfsec:ignore:aws-vpc-no-public-ingress-sgr\n}\n```\n\n...or...\n\n```terraform\nresource \"aws_security_group_rule\" \"my-rule\" {\n    type = \"ingress\"\n    #tfsec:ignore:aws-vpc-no-public-ingress-sgr\n    cidr_blocks = [\"0.0.0.0/0\"]\n}\n```\n\nIf you're not sure which line to add the comment on, just check the\ntfsec output for the line number of the discovered problem.\n\nYou can ignore multiple rules by concatenating the rules on a single line:\n\n```terraform\n#tfsec:ignore:aws-s3-enable-bucket-encryption tfsec:ignore:aws-s3-enable-bucket-logging\nresource \"aws_s3_bucket\" \"my-bucket\" {\n  bucket = \"foobar\"\n  acl    = \"private\"\n}\n```\n\n### Expiration Date\nYou can set expiration date for `ignore` with `yyyy-mm-dd` format. This is a useful feature when you want to ensure ignored issue won't be forgotten and should be revisited in the future.\n```\n#tfsec:ignore:aws-s3-enable-bucket-encryption:exp:2025-01-02\n```\nIgnore like this will be active only till `2025-01-02`, after this date it will be deactivated.\n\n## Disable checks\n\nYou may wish to exclude some checks from running. If you'd like to do so, you can\nsimply add new argument `-e check1,check2,etc` to your cmd command\n\n```bash\ntfsec . -e general-secrets-sensitive-in-variable,google-compute-disk-encryption-customer-keys\n```\n\n## Including values from .tfvars\n\nYou can include values from a tfvars file in the scan,  using, for example: `--tfvars-file terraform.tfvars`.\n\n## Included Checks\n\ntfsec supports many popular cloud and platform providers\n\n| Checks                                                                                  |\n|:----------------------------------------------------------------------------------------|\n| [AWS Checks](https://aquasecurity.github.io/tfsec/latest/checks/aws/)                   |\n| [Azure Checks](https://aquasecurity.github.io/tfsec/latest/checks/azure/)               |\n| [GCP Checks](https://aquasecurity.github.io/tfsec/latest/checks/google/)                |\n| [CloudStack Checks](https://aquasecurity.github.io/tfsec/latest/checks/cloudstack/)     |\n| [DigitalOcean Checks](https://aquasecurity.github.io/tfsec/latest/checks/digitalocean/) |\n| [GitHub Checks](https://aquasecurity.github.io/tfsec/latest/checks/github/)             |\n| [Kubernetes Checks](https://aquasecurity.github.io/tfsec/latest/checks/kubernetes/)     |\n| [OpenStack Checks](https://aquasecurity.github.io/tfsec/latest/checks/openstack/)       |\n| [Oracle Checks](https://aquasecurity.github.io/tfsec/latest/checks/oracle/)             |\n\n## Running in CI\n\ntfsec is designed for running in a CI pipeline. You may wish to run tfsec as part of your build without coloured\noutput. You can do this using `--no-colour` (or `--no-color` for our American friends).\n\n## Output options\n\nYou can output tfsec results as JSON, CSV, Checkstyle, Sarif, JUnit or just plain old human-readable format. Use the `--format` flag\nto specify your desired format.\n\n## GitHub Security Alerts\nIf you want to integrate with Github Security alerts and include the output of your tfsec checks you can use the [tfsec-sarif-action](https://github.com/marketplace/actions/run-tfsec-with-sarif-upload) Github action to run the static analysis then upload the results to the security alerts tab.\n\nThe alerts generated for [tfsec-example-project](https://github.com/tfsec/tfsec-example-project) look like this.\n\n![github security alerts](codescanning.png)\n\nWhen you click through the alerts for the branch, you get more information about the actual issue.\n\n![github security alerts](scanningalert.png)\n\nFor more information about adding security alerts, check [the GitHub documentation](https://docs.github.com/en/code-security/repository-security-advisories/about-github-security-advisories-for-repositories)\n\n## Support for older terraform versions\n\nIf you need to support versions of terraform which use HCL v1\n(terraform \u003c0.12), you can use `v0.1.3` of tfsec, though support is\nvery limited and has fewer checks.\n\n## Contributing\n\nWe always welcome contributions; big or small, it can be documentation updates, adding new checks or something bigger. Please check the [Contributing Guide](CONTRIBUTING.md) for details on how to help out.\n\n### Some People who have contributed\n\n\u003ca href = \"https://github.com/aquasecurity/tfsec/graphs/contributors\"\u003e\n  \u003cimg src = \"https://contrib.rocks/image?repo=aquasecurity/tfsec\"/\u003e\n\u003c/a\u003e\n\nMade with [contributors-img](https://contrib.rocks).\n\n`tfsec` is an [Aqua Security](https://aquasec.com) open source project.\nLearn about our open source work and portfolio [here](https://www.aquasec.com/products/open-source-projects/).\nJoin the community, and talk to us about any matter in [GitHub Discussion](https://github.com/aquasecurity/tfsec/discussions) or [Slack](https://slack.aquasec.com).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faquasecurity%2Ftfsec","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Faquasecurity%2Ftfsec","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faquasecurity%2Ftfsec/lists"}