Set up tfsec for your Terraform

tfsec is a static analysis tool for your Terraform code.

It has different rules that you can enable against different major cloud providers.

Here’s some example output (taken from their README):

If your organization enables teams to use Terraform, enabling tfsec is a good first line of defense for potential security issues.

Note: It seems like tfsec is migrating to Trivy. I haven’t evaluated Trivy yet, but have used tfsec to good effect in the past.

---