tfsec (Terraform Security Scanner)

Open-source static analysis security scanner for Terraform IaC. Detects security misconfigurations in Terraform configurations before deployment — checks for insecure S3 buckets, open security groups, unencrypted resources, missing logging, and hundreds of other cloud security best practice violations across AWS, Azure, GCP, and other providers. Part of Aqua Security's open-source toolchain.

Evaluated Mar 07, 2026 (0d ago) vcurrent
Homepage ↗ Repo ↗ Security terraform iac security static-analysis misconfiguration open-source aqua cloud
⚙ Agent Friendliness
67
/ 100
Can an agent use this?
🔒 Security
96
/ 100
Is it safe for agents?
⚡ Reliability
84
/ 100
Does it work consistently?

Score Breakdown

⚙ Agent Friendliness

MCP Quality
--
Documentation
85
Error Messages
82
Auth Simplicity
100
Rate Limits
95

🔒 Security

TLS Enforcement
100
Auth Strength
95
Scope Granularity
95
Dep. Hygiene
92
Secret Handling
95

Open-source (MIT) — fully auditable. Runs entirely locally — no Terraform code sent to external services. Maintained by Aqua Security, a reputable security company. No credentials needed.

⚡ Reliability

Uptime/SLA
95
Version Stability
80
Breaking Changes
78
Error Recovery
85
AF Security Reliability

Best When

You're working with Terraform-based infrastructure and need fast, targeted IaC security scanning integrated into CI/CD without complexity.

Avoid When

You need multi-IaC support across Terraform, CloudFormation, Kubernetes, and Ansible — Checkov covers all of these in one tool.

Use Cases

  • Scan Terraform plans and configurations in agent-driven CI/CD pipelines to catch security misconfigurations before cloud deployment
  • Automate IaC security gating — fail agent-managed Terraform deployments when critical security findings are detected
  • Audit AI infrastructure Terraform configurations for security compliance before provisioning cloud resources for agent workloads
  • Generate structured JSON security reports from Terraform scans for agent-driven policy enforcement workflows
  • Integrate tfsec into agent DevSecOps pipelines that validate infrastructure security automatically on every PR

Not For

  • Runtime cloud security monitoring — tfsec scans IaC at design time; use Prowler or CloudSploit for deployed resource scanning
  • Non-Terraform IaC — use Checkov for multi-IaC support (CloudFormation, Kubernetes YAML, Ansible); tfsec is Terraform-specific
  • SAST for application code — tfsec is IaC-specific; use Semgrep or SonarQube for application code security

Interface

REST API
No
GraphQL
No
gRPC
No
MCP Server
No
SDK
No
Webhooks
No

Authentication

Methods: none
OAuth: No Scopes: No

No authentication required — open-source CLI tool. No external API calls during scanning. Scans run entirely locally against Terraform source files.

Pricing

Model: open_source
Free tier: Yes
Requires CC: No

tfsec core is free and open-source (MIT). Aqua Security offers commercial products that include tfsec functionality with management UI.

Agent Metadata

Pagination
none
Idempotent
Full
Retry Guidance
Not documented

Known Gotchas

  • tfsec is being deprecated in favor of Trivy IaC scanning — Aqua now recommends using `trivy config` for IaC scanning; tfsec may not receive updates
  • Custom check rules require Go or YAML — agents cannot define ad-hoc checks without writing check files
  • Terraform modules referenced from external sources (registry, git) may not be scanned — only local module source code is analyzed
  • Exit code 1 indicates findings, not errors — agents must distinguish scan execution failures from policy violations
  • Finding severity levels (CRITICAL, HIGH, MEDIUM, LOW) are relative to Terraform security — may not align with your organization's severity taxonomy
  • JSON output format changed between versions — pin tfsec version in CI to avoid parsing breakage when upgrading

Alternatives

Full Evaluation Report

Comprehensive deep-dive: security analysis, reliability audit, agent experience review, cost modeling, competitive positioning, and improvement roadmap for tfsec (Terraform Security Scanner).

AI-powered analysis · PDF + markdown · Delivered within 30 minutes

$99

Package Brief

Quick verdict, integration guide, cost projections, gotchas with workarounds, and alternatives comparison.

Delivered within 10 minutes

$3

Score Monitoring

Get alerted when this package's AF, security, or reliability scores change significantly. Stay ahead of regressions.

Continuous monitoring

$3/mo

Scores are editorial opinions as of 2026-03-07.

6470
Packages Evaluated
26150
Need Evaluation
173
Need Re-evaluation
Community Powered