tfsec

tfsec scans Terraform code defining S3 buckets.

tfsec identifies buckets with `acl = "public-read"` or similar configurations.

tfsec reports the violation, highlighting the specific line of code.

Developers modify the Terraform code to restrict bucket access to private or authenticated users.

tfsec is re-run to verify the fix.

tfsec scans Terraform code defining EBS volumes.

tfsec identifies volumes without encryption enabled (`encrypted = false`).

tfsec reports the violation, specifying the resource name and line number.

Developers update the Terraform code to enable encryption on the EBS volumes.

tfsec is re-run to confirm the encryption settings.

tfsec scans Terraform code defining security group rules.

tfsec identifies rules with `cidr_blocks = ["0.0.0.0/0"]` or similar configurations that allow access from any IP address.

tfsec reports the overly permissive rule, highlighting the affected resource.

Developers modify the Terraform code to restrict access to specific IP addresses or CIDR blocks.

tfsec is re-run to ensure the security group rules are properly configured.

tfsec scans Terraform code defining KMS keys and resources that use them.

tfsec identifies cases where KMS keys are not properly configured or are missing.

tfsec reports the misconfiguration, providing details on the affected resources.

Developers correct the Terraform code to properly configure and use KMS keys.

tfsec is re-run to validate the fixes.

tfsec scans Terraform code for potential hardcoded secrets.

tfsec identifies any strings that resemble passwords or API keys.

tfsec reports the potential hardcoded secrets, highlighting the affected lines of code.

Developers remove the hardcoded secrets and replace them with secure alternatives (e.g., environment variables, secret management tools).

tfsec is re-run to verify that no hardcoded secrets remain.

tfsec scans Terraform code and checks for the presence of required tags.

tfsec identifies resources missing required tags.

tfsec reports the missing tags

Developers add the required tags to the Terraform code.

tfsec is re-run to ensure all the tags are present.