Tfsec + servasec
Static analysis for Terraform code to detect potential security issues.
What is Tfsec?
Tfsec is a static analysis tool for Terraform code that scans for security misconfigurations. It checks Terraform plans and code against a library of security best practices, covering AWS, Azure, GCP, and generic providers. Tfsec provides inline annotations and integrates with CI/CD pipelines for automated security checks.
Terraform-specific analysisAWS, Azure, GCP provider coverageInline code annotationsCustom rule supportTerraform plan scanning
Integrate Tfsec with servasec
1
Install Tfsec
Install Tfsec via the official script.
curl -fsSL https://raw.githubusercontent.com/aquasecurity/tfsec/master/install.sh | bash
2
Scan your Terraform
Run Tfsec against your Terraform directory.
tfsec . --format json --out results.json
3
Push to servasec
Send the results to servasec.
curl -X POST "$SSC_PUBLIC_URL/api/ingest" \ -H "X-Api-Token: $API_TOKEN" \ -F "[email protected]"
What servasec adds to Tfsec
IaC correlation
See Terraform findings alongside Checkov and Kubernetes scanner results.
Remediation tracking
Track Terraform security findings through detection to fix.
Provider-specific views
Filter findings by cloud provider (AWS, Azure, GCP).