Using tfsec to Scan Your Terraform Code
summary
tfsec scans .tf and .tf.json files and in the demo finds seven issues then reduces them to zero by adding an aws_s3_bucket_public_access_block and a KMS customer master key, fixing the ACL and encryption problems. It integrates as a tfsec CLI, a VSCode extension (live fixes and links to remediation) and a GitHub Actions PR commenter that posts findings and can fail a PR. Custom checks live in a .tfsec folder (example: require a cost_center tag or names ending with “sg”) and they work as shown.
AI-written summary · about
chapters (7)
- 0:00Introduction to misconfigurations
- 4:20What is tfsec
- 7:53Demo setup and scanning
- 14:15Integrating tfsec in CI
- 18:30VS Code plugin demo
- 21:59Custom checks with tfsec
- 29:23Key takeaways and conclusion
related talks
14mIdentifying Misconfigurations in your Terraform
37mStatic Code Analysis of Terraform based Infrastructure as Code IaC scripts
01h 00mSecurely deploying Infrastructure as Code
29mShifting Terraform Configuration Security Left
31mStreamlining Compliance: Leveraging Open-Source Terraform AWS modules
22mSecurity vs Dev Experience Threat … or Opportunity
33mSecurity scans for terraform templates
14mLightning Talk: 5 Security Tips for Terraform