bridgecrewio/terragoat resource

Health v2 · maintenance only

Adoption not part of the score

1305 stars · 5832 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

TerraGoat is Bridgecrew's 'Vulnerable by Design' Terraform repository containing intentionally misconfigured cloud infrastructure for AWS, Azure, and GCP. It serves as a training ground for practicing secure infrastructure-as-code development and testing policy-as-code scanners like Checkov.

Use cases

• test a policy-as-code scanner against intentionally vulnerable terraform
• train devsecops engineers on common cloud misconfigurations
• demo cloud security scanning tools like checkov
• practice finding infrastructure-as-code vulnerabilities in aws azure and gcp
• set up a vulnerable terraform environment for security workshops
• evaluate inline linters and pre-commit hooks for terraform security

When to choose

• you need a safe baseline of vulnerable Terraform code to test IaC security scanners
• you are teaching or learning DevSecOps and cloud misconfiguration prevention
• you want to demo or benchmark tools like Checkov, Bridgecrew, or other policy-as-code frameworks

When to avoid

• you need production-ready secure Terraform modules
• you cannot risk deploying vulnerable resources into a real cloud account
• you are looking for a security scanning tool rather than vulnerable sample code

Facets

learning-resource · maturity active

security infrastructure-as-code testing developer-tools security cloud-computing infrastructure-as-code tutorials cross-platform cli vulnerable-by-design terraform devsecops policy-as-code misconfiguration aws azure gcp checkov training devops

Member repositories

For agents

markdown · JSON · MCP: product_card(name="bridgecrewio/terragoat")