Security scanner for your Terraform code
Alternatives To Tfsec
Project NameStarsDownloadsRepos Using ThisPackages Using ThisMost Recent CommitTotal ReleasesLatest ReleaseOpen IssuesLicenseLanguage
Tfsec5,935135 days ago404September 21, 2022114mitGo
Security scanner for your Terraform code
Checkov5,650411 hours ago2,207July 07, 2022142apache-2.0Python
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
Terrascan4,08014 days ago58June 13, 2022187apache-2.0Go
Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.
Horusec88322 months ago40November 30, 202173apache-2.0Go
Horusec is an open source tool that improves identification of vulnerabilities in your project with just one command.
Checkov Action153
2 days ago15apache-2.0HCL
This GitHub Action runs Checkov against infrastructure-as-code, open source packages, container images, and CI/CD configurations to identify misconfigurations, vulnerabilities, and license compliance issues.
Terraform Security Scan104
5 months ago5mitShell
Run a security scan on your terraform with the very nice
4 days ago8PowerShell
Install scripts for cnquery & cnspec
4 years agomitHCL
Leverage the ability of Terraform and AWS or GCP to distribute large security scans across numerous cloud instances.
Terraform Aws S3 Anti Virus37
2 days ago2bsd-3-clauseHCL
Creates and configures Anti-Virus Scanning of S3 Buckets.
Terraform Aws Scanner32
4 years ago7mitHCL
Terraform module which provides easy to configure AWS environment for running automated security scanning solutions at scheduled intervals.
Alternatives To Tfsec
Select To Compare

Alternative Project Comparisons

GoReportCard Join Our Slack Docker Build Homebrew Chocolatey AUR version VScode Extension

tfsec uses static analysis of your terraform code to spot potential misconfigurations.


  • ☁️ Checks for misconfigurations across all major (and some minor) cloud providers
  • ⛔️ Hundreds of built-in rules
  • :nesting_dolls: Scans modules (local and remote)
  • ➕ Evaluates HCL expressions as well as literal values
  • ↪️ Evaluates Terraform functions e.g. concat()
  • 🔗 Evaluates relationships between Terraform resources
  • :toolbox: Compatible with the Terraform CDK
  • 🙅 Applies (and embellishes) user-defined Rego policies
  • 📃 Supports multiple output formats: lovely (default), JSON, SARIF, CSV, CheckStyle, JUnit, text, Gif.
  • 🛠 Configurable (via CLI flags and/or config file)
  • ⚡️ Very fast, capable of quickly scanning huge repositories
  • 🔌 Plugins for popular IDEs available (JetBrains, VSCode and Vim)
  • 🏡 Community-driven - come and chat with us on Slack!

Recommended by Thoughtworks

Rated Adopt by the Thoughtworks Tech Radar:

For our projects using Terraform, tfsec has quickly become a default static analysis tool to detect potential security risks. It's easy to integrate into a CI pipeline and has a growing library of checks against all of the major cloud providers and platforms like Kubernetes. Given its ease of use, we believe tfsec could be a good addition to any Terraform project.

Example Output

Example screenshot


Install with brew/linuxbrew

brew install tfsec

Install with Chocolatey

choco install tfsec

Install with Scoop

scoop install tfsec

Bash script (Linux):

curl -s | bash

You can also grab the binary for your system from the releases page.

Alternatively, install with Go:

go install[email protected]

Please note that using go install will install directly from the master branch and version numbers will not be reported via tfsec --version.


The binaries on the releases page are signed with the tfsec signing key D66B222A3EA4C25D5D1A097FC34ACEFB46EC39CE

Form more information check the signing page for instructions on verification.


tfsec will scan the specified directory. If no directory is specified, the current working directory will be used.

The exit status will be non-zero if tfsec finds problems, otherwise the exit status will be zero.

tfsec .

Use with Docker

As an alternative to installing and running tfsec on your system, you may run tfsec in a Docker container.

There are a number of Docker options available

Image Name Base Comment
aquasec/tfsec alpine Normal tfsec image
aquasec/tfsec-alpine alpine Exactly the same as aquasec/tfsec, but for those whole like to be explicit
aquasec/tfsec-ci alpine tfsec with no entrypoint - useful for CI builds where you want to override the command
aquasec/tfsec-scratch scratch An image built on scratch - nothing frilly, just runs tfsec

To run:

docker run --rm -it -v "$(pwd):/src" aquasec/tfsec /src

Use with Visual Studio Code

A Visual Studio Code extension is being developed to integrate with tfsec results. More information can be found on the tfsec Marketplace page

Use as GitHub Action

If you want to run tfsec on your repository as a GitHub Action, you can use aquasecurity/tfsec-pr-commenter-action.

Use as an Azure DevOps Pipelines Task

You can now install the official tfsec task. Please raise any issues/feature requests on the task repository.

Ignoring Warnings

You may wish to ignore some warnings. If you'd like to do so, you can simply add a comment containing tfsec:ignore:<rule> to the offending line in your templates. Alternatively, you can add the comment to the line above the block containing the issue, or to the module block to ignore all occurrences of an issue inside the module.

For example, to ignore an open security group rule:

resource "aws_security_group_rule" "my-rule" {
    type = "ingress"
    cidr_blocks = [""] #tfsec:ignore:aws-vpc-no-public-ingress-sgr


resource "aws_security_group_rule" "my-rule" {
    type = "ingress"
    cidr_blocks = [""]

If you're not sure which line to add the comment on, just check the tfsec output for the line number of the discovered problem.

You can ignore multiple rules by concatenating the rules on a single line:

#tfsec:ignore:aws-s3-enable-bucket-encryption tfsec:ignore:aws-s3-enable-bucket-logging
resource "aws_s3_bucket" "my-bucket" {
  bucket = "foobar"
  acl    = "private"

Expiration Date

You can set expiration date for ignore with yyyy-mm-dd format. This is a useful feature when you want to ensure ignored issue won't be forgotten and should be revisited in the future.


Ignore like this will be active only till 2025-01-02, after this date it will be deactivated.

Disable checks

You may wish to exclude some checks from running. If you'd like to do so, you can simply add new argument -e check1,check2,etc to your cmd command

tfsec . -e general-secrets-sensitive-in-variable,google-compute-disk-encryption-customer-keys

Including values from .tfvars

You can include values from a tfvars file in the scan, using, for example: --tfvars-file terraform.tfvars.

Included Checks

tfsec supports many popular cloud and platform providers

AWS Checks
Azure Checks
GCP Checks
CloudStack Checks
DigitalOcean Checks
GitHub Checks
Kubernetes Checks
OpenStack Checks
Oracle Checks

Running in CI

tfsec is designed for running in a CI pipeline. You may wish to run tfsec as part of your build without coloured output. You can do this using --no-colour (or --no-color for our American friends).

Output options

You can output tfsec results as JSON, CSV, Checkstyle, Sarif, JUnit or just plain old human-readable format. Use the --format flag to specify your desired format.

GitHub Security Alerts

If you want to integrate with Github Security alerts and include the output of your tfsec checks you can use the tfsec-sarif-action Github action to run the static analysis then upload the results to the security alerts tab.

The alerts generated for tfsec-example-project look like this.

github security alerts

When you click through the alerts for the branch, you get more information about the actual issue.

github security alerts

For more information about adding security alerts, check the GitHub documentation

Support for older terraform versions

If you need to support versions of terraform which use HCL v1 (terraform <0.12), you can use v0.1.3 of tfsec, though support is very limited and has fewer checks.


We always welcome contributions; big or small, it can be documentation updates, adding new checks or something bigger. Please check the Contributing Guide for details on how to help out.

Some People who have contributed

Made with contributors-img.

tfsec is an Aqua Security open source project. Learn about our open source work and portfolio here. Join the community, and talk to us about any matter in GitHub Discussion or Slack.

Popular Terraform Projects
Popular Scanner Projects
Popular Configuration Management Categories
Related Searches

Get A Weekly Email With Trending Projects For These Categories
No Spam. Unsubscribe easily at any time.
Google Cloud Platform
Static Analysis
Infrastructure As Code
Vulnerability Scanners