Static Analysis (Security scanner) for Terraform Code

in Cloud Computing , DevSecOps , DevOps

    What is Terraform?

    Terraform is an open-source infrastructure as code software tool that provides a consistent CLI workflow to manage hundreds of cloud services. Terraform codifies cloud APIs into declarative configuration files. (Source →

    Basically, we use terraform tool to provision cloud services from CLI using the code.

    But can we check if our terrafrom code has some security flaws??

    YES. We can. Using TFsec tool.

    TFsec uses HCL parser to understand the terraform code and have many default checks in place already. They also give you freedom to write your own custom checks.

    You can run this tool in you CI pipeline (also in github actions) and check your code before making changes to cloud. And the best thing it is supported in all the mostly used OS.. and they have a docker container as well (which I love btw).

    You can download yourself one form here →

    And they are also Open Source. That means you can read the code and make changes to it that suits you best. And also you can help to make it better. Just like tons of people who are making it better everyday.

    “Gettign Hands Dirty” Time

    I already had some test code for Terraform and I intentionally added a default secret key variable (which I know is a bad idea from a security point of view).

    variable file with default secret key variable file with default secret key

    I am now expecting any security scanner to detect this type of behavior and report it.
    After the code was ready… I pulled and created a container for tfsec and mounted my code repository in that to perform scanning.

    docker run --rm -it -v $PWD:/src tfsec/tfsec /src

    And as expected,

    scan report from tfsec scan report from tfsec

    It gave me a good human readable report with all the highlighted potential issues along with the time taken for everything. Since it is using HCL parser to parse every thing.. It also gives me warning/errors in my code.


    Get similar stories in your inbox weekly, for free

    Share this story with your friends
    Rishabh Umrao, Information Security Engineer @ Sophos

    Another Computer Science and Engineering Graduate (B.Tech) from india with a strong interest in Devops, Security and Automation.

    Latest stories

    200 Million Certificates in 24 Hours

    Let's Encrypt has been providing free Certificate Authority (CA) for websites in need of them …

    Gatling VS K6

    Gatling and K6 are performance load testing tools, and they are both open source, easy …

    Red Hat Ansible Platform 1 vs 2; What’s the Difference?

    Red Hat Ansible is a platform used by enterprises to manage, unify and execute infrastructure …

    Domino Data Labs Raised $100 Million in the Latest Funding Round

    Culled from the news released by Domino Data labs on funding and the company's progress …

    New Release: The Microsoft Azure Purview Is Now Available on General Availability

    News report detailing the announcement of the release of Azure purview on GA

    Google Introduces Online Training Program to Improve Cloud Skills

    Google addresses existing cloud personnel deficiency with training programs.