tfsec

tfsec <tf-dir>

Scans Terraform infrastructure as code with tfsec, detecting resource-specific security misconfigurations.

Run it in the IaC pipeline when you want Terraform analysis with the specific tool: tfsec analyzes .tf files and reports findings — resource misconfigurations (security groups, buckets, IAM policies, encryption) — with the rule (AVD), severity, and line. It is the reference Terraform scanner (from Aqua): language-specific analysis. In DevSecOps, tfsec is the gate for the Terraform pipeline: the plan with high-severity findings is blocked before apply.

Do not use it as a complete analysis: tfsec covers Terraform — the rest of IaC (CloudFormation, K8s) is covered with Checkov (044/047) and app code with SAST. Generic rules generate false positives: they are triaged (the .tfsec config). And note: tfsec (from Aqua) is in maintenance mode (development was integrated into Trivy) — the tool still works, but Trivy (config) is the evolution; review the choice. tfsec is the specific analysis; Checkov the multi-format.