Terraform IaC Security Scanning: How to Find and Fix Misconfigurations Before They Reach Production Using tfsec, Checkov, and Trivy

tfsec is the most widely used Terraform-specific IaC scanner. Install and run:

# Install via brew (macOS)
brew install tfsec

# Or via Docker
docker pull aquasec/tfsec

# Run against a Terraform directory
tfsec ./terraform/ --format lovely

# JSON output for CI processing
tfsec ./terraform/ --format json > tfsec-results.json

# SARIF output for GitHub Security tab
tfsec ./terraform/ --format sarif > tfsec-results.sarif

tfsec evaluates each .tf file in the target directory and reports findings with:

• Rule ID (e.g., aws-s3-no-public-access)
• Severity (Critical, High, Medium, Low)
• File and line number
• Description and remediation guidance
• Link to documentation

For a quick first run on an existing codebase, pipe to a severity filter:

tfsec ./terraform/ --minimum-severity HIGH --format lovely

This shows only High and Critical findings, giving you the most impactful starting point without overwhelming the team with hundreds of Medium and Low findings at once.

These resource types produce the highest-frequency high-severity findings across AWS, Azure, and GCP:

AWS S3 Buckets:

# WRONG: Public access not blocked
resource "aws_s3_bucket" "data" {
  bucket = "company-data-bucket"
}
# Missing: aws_s3_bucket_public_access_block, aws_s3_bucket_server_side_encryption_configuration

# CORRECT:
resource "aws_s3_bucket_public_access_block" "data" {
  bucket = aws_s3_bucket.data.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

AWS Security Groups:

# WRONG: All traffic inbound
resource "aws_security_group_rule" "allow_all" {
  type        = "ingress"
  from_port   = 0
  to_port     = 65535
  protocol    = "-1"
  cidr_blocks = ["0.0.0.0/0"] # tfsec: aws-vpc-no-public-ingress-sgr
}

Azure Storage Accounts:

# WRONG: HTTPS not required, minimum TLS not enforced
resource "azurerm_storage_account" "main" {
  name                     = "companystorage"
  resource_group_name      = azurerm_resource_group.main.name
  location                 = azurerm_resource_group.main.location
  account_tier             = "Standard"
  account_replication_type = "GRS"
  # Missing: enable_https_traffic_only, min_tls_version, network_rules
}

GCP Cloud Storage:

# WRONG: Public IAM binding
resource "google_storage_bucket_iam_member" "public" {
  bucket = google_storage_bucket.data.name
  role   = "roles/storage.objectViewer"
  member = "allUsers" # tfsec: google-storage-no-public-access
}

Add scanning to every pull request that modifies .tf files:

# .github/workflows/terraform-security.yml
name: Terraform Security Scan

on:
  pull_request:
    paths:
      - '**.tf'
      - '**.tfvars'

permissions:
  security-events: write  # required for SARIF upload
  contents: read

jobs:
  tfsec:
    name: tfsec
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Run tfsec
        uses: aquasecurity/tfsec-sarif-action@v0.1.4
        with:
          sarif_file: tfsec.sarif
          minimum_severity: HIGH

      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: tfsec.sarif

  checkov:
    name: Checkov
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Run Checkov
        uses: bridgecrewio/checkov-action@v12
        with:
          directory: terraform/
          framework: terraform
          output_format: sarif
          output_file_path: checkov.sarif
          soft_fail: true  # set to false to block PRs on high findings

      - name: Upload Checkov SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: checkov.sarif

Set soft_fail: false once the existing finding backlog is resolved. With soft_fail: false, any High or Critical finding blocks the PR merge. Upload SARIF to the GitHub Security tab so findings are tracked as code scanning alerts alongside SAST results.

Some findings are intentional. A public S3 bucket hosting a static website, a security group allowing 443 from the world for a load balancer, or a non-encrypted bucket for cost optimization in a staging environment. Suppression must be documented and scoped.

For tfsec, use inline ignore comments:

resource "aws_s3_bucket" "website" {
  bucket = "company-public-website"
  # tfsec:ignore:aws-s3-no-public-access -- Public website bucket, approved exception TICKET-4521
}

For Checkov, use checkov:skip comments:

resource "aws_security_group_rule" "alb_https" {
  type        = "ingress"
  from_port   = 443
  to_port     = 443
  protocol    = "tcp"
  cidr_blocks = ["0.0.0.0/0"]
  # checkov:skip=CKV_AWS_25: ALB HTTPS inbound -- public-facing load balancer, approved
}

Policies for suppression:

• Require a ticket reference in every suppression comment
• Review all suppressions quarterly in a PR
• Never suppress at a module level or directory level (file-level .tfsec-ignore files) without CISO approval
• Track suppression count as a metric: if it grows faster than the team's review cadence, the tool is being misused

For custom organization rules that the public scanners do not cover (e.g., required tags on all resources, specific naming conventions), tfsec supports custom rule YAML files placed in a .tfsec/ directory in the repo.

Trivy is a broader security scanner that covers IaC, container images, and secrets in a single tool. For Terraform, Trivy replicates most tfsec and Checkov checks and adds secrets detection (hardcoded API keys, passwords, AWS access keys in Terraform variable files).

# Scan Terraform directory for misconfigurations and secrets
trivy fs ./terraform/ --scanners misconfig,secret --format table

# JSON output
trivy fs ./terraform/ --scanners misconfig,secret --format json > trivy-results.json

Trivy is particularly useful for detecting hardcoded secrets in .tfvars files and in resource arguments that should reference variable inputs:

# WRONG: Hardcoded credential in Terraform resource
resource "aws_db_instance" "main" {
  password = "hardcoded_password_123"  # Trivy: secret detection
  # Should be: password = var.db_password or a Secrets Manager reference
}

For secrets in Terraform state files (a separate problem): Terraform state can contain sensitive values in plaintext. Always use remote state with encryption at rest (S3 + SSE, Terraform Cloud, or Azure Backend with customer-managed keys). Add state file locations to your .gitignore and run Trivy on your repository to ensure no .tfstate files are committed.