aquasecurity/tfsec

Health v2 · maintenance only

Adoption not part of the score

7035 stars · 559 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

tfsec is a static analysis security scanner for Terraform code that detects misconfigurations across major cloud providers using hundreds of built-in rules. It has been merged into Trivy, which now provides the same Terraform scanning engine alongside broader vulnerability and secret scanning.

Use cases

• scan terraform code for security misconfigurations
• check aws security groups in terraform before deploy
• run terraform security checks in ci pipeline
• find unencrypted s3 buckets in infrastructure code
• audit terraform modules for compliance issues
• enforce rego policies on terraform configs

When to choose

• you need a dedicated terraform-only static analysis tool
• you want lightweight terraform misconfiguration checks without broader scanning features
• you maintain an existing tfsec-based pipeline

When to avoid

• you are starting a new project - use Trivy instead, which natively supports Terraform scanning
• you need vulnerability, secret, or container scanning alongside IaC checks
• you expect active new feature development, since engineering effort has moved to Trivy

Facets

cli-tool · maturity maintenance

vulnerability-scanning static-site-generator linter ci-cd security security infrastructure-as-code cloud-computing windows cli editor-plugin terraform iac-scanning misconfiguration-detection devsecops trivy-migration static-analysis devops linux macos docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="aquasecurity/tfsec")