tfsec

Scan the current directory for security issues

$ tfsec

$ tfsec [path/to/terraform]

$ tfsec --format json

$ tfsec -e [check1,check2]

$ tfsec --tfvars-file [terraform.tfvars]

$ tfsec --minimum-severity HIGH

$ tfsec --format json --out [results.json]

$ tfsec --exclude-path [path/to/exclude]

tfsec [options] [directory]

tfsec is a static analysis security scanner for Terraform code. It analyzes Terraform files to detect potential security misconfigurations, policy violations, and best practice issues before infrastructure is deployed.
The scanner runs locally and in CI/CD pipelines, providing developer-friendly output with documented checks. It supports multiple output formats for integration with various tools and platforms. Issues are categorized by severity to help prioritize remediation efforts.
tfsec can be configured via command-line flags, configuration files, or environment variables (prefixed with TFSEC_). Inline comments can also be used to ignore specific warnings in Terraform files.

--format format

Output format: default, json, csv, checkstyle, sarif, junit, gif, or text.

Write results to a file instead of stdout.

Comma-separated list of check IDs to exclude from the scan.

Exclude specific directories from scanning.

Filter results by minimum severity: LOW, MEDIUM, HIGH, or CRITICAL.

Include variable values from a tfvars file in the scan.

Use a custom configuration file (default: tfsec-config.json).

Disable colored output (useful for CI pipelines).

Exit with code 0 even if issues are found.

Include results that have been marked as ignored.

Include checks that passed in the output.

Display version information and exit.

Display help message and exit.

tfsec is being deprecated and merged into Trivy. For new projects, consider using trivy config instead. Existing tfsec users should plan migration to Trivy for continued updates and support.

tfsec was created by Liam Galvin and released in 2019 as an open-source Terraform security scanner. It was later acquired by Aqua Security in 2021 and became part of their open-source security tooling portfolio. In 2023, Aqua announced that tfsec would be merged into their comprehensive security scanner Trivy, with tfsec entering maintenance mode.

trivy(1), terraform(1), checkov(1), terrascan(1)