auditing-terraform-infrastructure-for-security

name	auditing-terraform-infrastructure-for-security
description	Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA/Rego policies to detect overly permissive IAM policies, public resource exposure, missing encryption, and insecure defaults before cloud deployment.
domain	cybersecurity
subdomain	cloud-security
tags	["cloud-security","terraform","infrastructure-as-code","checkov","tfsec","policy-as-code"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]

Auditing Terraform Infrastructure for Security

When to Use

• When integrating security scanning into CI/CD pipelines for Terraform deployments
• When reviewing Terraform plans and modules for security best practices before applying
• When building policy-as-code guardrails for cloud infrastructure provisioning
• When auditing existing Terraform state files to identify deployed misconfigurations
• When enforcing organizational security standards across multiple Terraform projects

Do not use for runtime security monitoring (use CSPM tools), for application security testing (use SAST/DAST tools), or for cloud configuration drift detection (use AWS Config or Azure Policy after deployment).

Prerequisites

• Checkov installed (pip install checkov)
• tfsec installed (brew install tfsec or binary from GitHub)
• Terrascan installed (brew install terrascan)
• Terraform v1.0+ for plan generation
• OPA (Open Policy Agent) for custom policy enforcement
• Git repository with Terraform code to audit

Workflow

Step 1: Scan Terraform Code with Checkov

Run Checkov for comprehensive IaC security scanning with built-in and custom policies.

# Scan a Terraform directory
checkov -d ./terraform/ --framework terraform

# Scan with specific check categories
checkov -d ./terraform/ --check CKV_AWS_18,CKV_AWS_19,CKV_AWS_20,CKV_AWS_21

# Scan and output results in JSON
checkov -d ./terraform/ --output json > checkov-results.json

# Scan a Terraform plan file for more accurate analysis
terraform init && terraform plan -out=tfplan
terraform show -json tfplan > tfplan.json
checkov -f tfplan.json --framework terraform_plan

# Skip specific checks with justification
checkov -d ./terraform/ --skip-check CKV_AWS_145 \
  --bc-api-key $BRIDGECREW_API_KEY

# Scan Terraform modules
checkov -d ./modules/ --framework terraform --compact

# List all available checks
checkov --list --framework terraform | grep CKV_AWS

Step 2: Scan with tfsec for Terraform-Specific Issues

Use tfsec for Terraform-native security analysis with detailed remediation guidance.

# Scan a Terraform directory
tfsec ./terraform/


tfsec ./terraform/ --minimum-severity HIGH


tfsec ./terraform/ --format json > tfsec-results.json


tfsec ./terraform/ --custom-check-dir ./custom-checks/


tfsec ./terraform/ --exclude-downloaded-modules \
  --exclude aws-s3-enable-bucket-logging


tfsec ./terraform/ --minimum-severity CRITICAL --soft-fail


tfsec ./terraform/ --format sarif > tfsec.sarif