tfsec
Terraform-only static scanner that evaluates HCL with modules and variables. Its engine now lives in Trivy as trivy config.
github.com/aquasecurity/tfsec ↗- Stars
- ★ 7,048
- License
- MIT
- Language
- Go
- Latest release
- v1.28.14 · 2 May 2025
- Last push
- 25 Mar 2026
- OpenSSF Scorecard
- 4.7 / 10
Aqua has moved the engine into Trivy and asks users to switch; tfsec only gets dependency bumps and last shipped in May 2025.
How it works
tfsec is a Go CLI for Terraform only. It parses .tf files with HashiCorp's HCL library and evaluates them the way Terraform would: variables and tfvars files, locals, functions such as concat(), and local and remote modules. Remote modules are downloaded unless --no-module-downloads is set.
Built-in checks come from Aqua's defsec library and are written in Go, covering AWS, Azure, Google Cloud and others, plus four GitHub provider checks (plaintext action secrets, signed commits in branch protection, vulnerability alerts, private repositories). You can add JSON or YAML checks in files ending _tfchecks.json or _tfchecks.yaml under .tfsec/, built from requiredTypes, requiredLabels and matchSpec actions such as contains, equals and regexMatches, or write Rego policies.
Output is lovely (the default terminal view), json, sarif, csv, checkstyle, junit or text. The run fails on findings unless --soft-fail is set, and --minimum-severity filters. A #tfsec:ignore:<rule> comment on the line or block suppresses a finding, and adding :exp:YYYY-MM-DD makes the ignore expire.
What it catches
- Public S3 buckets and missing bucket encryption
- Security groups open to 0.0.0.0/0
- Unencrypted databases, disks and queues across clouds
- Plaintext values in github_actions_secret resources
- GitHub repositories created public or without vulnerability alerts
- Misconfigurations inside remote modules after they are evaluated
Run it
brew install tfsec
tfsec .
# replacement with the same engine:
trivy config .What leaves your machine
Remote Terraform modules are downloaded during the scan unless you pass --no-module-downloads. --custom-check-url and --config-file-url fetch files from the URL you give.
Limits
- Deprecated in favour of Trivy. Aqua says engineering attention goes to Trivy, and the last release, v1.28.14 in May 2025, only fixed CVEs in dependencies.
- New cloud resources and provider changes are not getting checks. Move to trivy config, which has the same engine plus more languages.
- Terraform only. It does not read Kubernetes, Dockerfiles or workflow files.
- The migration guide maps commands and flags but not ignore comments or custom JSON/YAML checks, so plan to rewrite those.
Links
Related tools
GitHub stats as of 10 Oct 2026. How ratings work.