tfsec vs Trivy

What happened to tfsec?#

Aqua encourages tfsec users to move to Trivy. The tfsec README says the project will remain available for the time being, but engineering attention is directed at Trivy.

The first command change is simple: replace tfsec <dir> with trivy config <dir>. The full migration is not necessarily a one-line swap because flags, check IDs, custom policies, suppressions, output schemas, and failure behavior may differ.

Aqua says tfsec laid the foundations for Trivy’s IaC scanning and that Trivy uses the same Terraform scanning engine. Treat that as a migration path, not proof of identical results or interfaces.

What are the key differences?#

The table follows current project documentation. Pin the exact releases you test because defaults and interfaces can change.

tfsec-to-Trivy migration details#

What Aqua officially says#

Aqua’s tfsec README says scanning work is being consolidated in Trivy. It describes tfsec as a foundation for Trivy’s IaC and Terraform scanning and encourages the community to transition.

The same statement says tfsec remains available for the time being. It does not say the repository has been deleted, that every form of maintenance stopped, or that every tfsec feature already behaves identically in Trivy.

That wording matters. “Engineering attention moved to Trivy” is supported; “tfsec gets no new checks” or “Trivy contains every tfsec rule unchanged” requires stronger release and catalog evidence.

What changes at the command line#

Aqua’s migration guide begins with this command change:

# Existing tfsec scan
tfsec <dir>

# Trivy configuration scan
trivy config <dir>

It also documents a different variable flag:

# tfsec
tfsec <dir> --tf-vars-file <vars.tf>

# Trivy
trivy config --tf-vars <vars.tf> <dir>

The guide shows separate report commands and notes that Trivy supplies table, JSON, SARIF, template, and SBOM output paths. Current Trivy documentation also supports converting saved JSON into other formats.

What does not follow from a shared engine#

A shared Terraform scanning foundation does not guarantee identical policy bundles or result contracts. Trivy retrieves built-in checks as a bundle, while tfsec has its own release and configuration history.

Check IDs can be renamed, replaced, split, or removed. Suppression syntax and scope may differ, even when two findings describe the same Terraform problem.

Custom Rego also needs testing. Trivy defines its own package, metadata, namespace, selector, input, and result conventions, so a policy that parses in tfsec is not automatically a valid Trivy policy.

JSON and SARIF consumers are another boundary. A dashboard, allowlist, or CI annotation may depend on field names and fingerprints rather than the visible finding message.

Trivy’s broader configuration scope#

Trivy’s current IaC coverage lists Terraform source, Terraform plan JSON or snapshots, CloudFormation, Azure ARM, Kubernetes, Helm, Dockerfiles, and arbitrary JSON or YAML.

This scope is broader than tfsec’s documented purpose as a Terraform static analyzer. It does not mean every Trivy parser uses the same check catalog or that putting several file types in one directory guarantees complete coverage.

Trivy also exposes targets for container images, filesystems, repositories, root filesystems, virtual machine images, Kubernetes clusters, and SBOMs. Those targets use different scanner combinations and may require separate credentials or databases.

Keep the migration focused. Replacing tfsec’s Terraform gate and adding image, repository, or cluster scanning are separate control changes and should be tested separately.

Reports and CI failure behavior#

tfsec returns a non-zero status when it finds problems unless configured otherwise. Its README documents human-readable, JSON, CSV, Checkstyle, SARIF, and JUnit output among its formats.

Trivy uses --exit-code to set the return code when matching issues are found. Severity and scanner filters affect what enters the report and can therefore affect the gate you build around it.

Test at least four cases: a clean Terraform fixture, a known policy failure, a parse error, and a scanner or checks-bundle failure. Keep those outcomes distinct in CI.

A zero-finding report is not enough if the wrong path was scanned or Terraform failed to parse. Preserve raw output during the migration window so differences can be investigated.

What should you do now?#

If tfsec is already blocking CI#

1. Pin the current tfsec version and repository revision.
2. Save its command, configuration, raw output, exit code, suppressions, and custom checks.
3. Run a pinned Trivy version with trivy config on the same inputs.
4. Compare findings, missing findings, new findings, parse errors, paths, IDs, severities, and exit codes.
5. Translate variable and report flags using Aqua’s migration guide.
6. Test each suppression and custom policy rather than copying it blindly.
7. Update JSON, SARIF, dashboard, and allowlist consumers.
8. Remove tfsec only after the Trivy gate reproduces the controls you need.

If you are starting a new project#

Evaluate Trivy first because Aqua directs engineering attention there. Build a small Terraform fixture set with one compliant and one failing example for each important policy.

If Trivy misses a requirement, write and test a custom Rego check or compare another maintained scanner. Checkov vs Trivy covers the IaC policy and target differences, while Checkov vs KICS compares two other policy models.

If migration exposes a gap#

Do not remove the existing control just to complete the tool migration. Keep a pinned tfsec job temporarily if it is the only tested implementation of a required check.

Record the gap with a failing fixture. Then replace it with a verified Trivy policy or another scanner and retire tfsec after the new control passes the same fixture.

Both projects appear in the IaC security tools category.

How this comparison was verified#

Official sources#

• tfsec README and transition statement
• Aqua’s tfsec-to-Trivy migration guide
• Trivy IaC coverage
• Trivy custom checks
• Trivy combined-input checks
• Trivy reporting
• Trivy configuration CLI reference
• Trivy repository and license

Frequently Asked Questions

Written & maintained by

Suphi Cankurt

Eight years on the vendor side of application-security sales — thousands of evaluations and demos. I started AppSec Santa in 2022 to put that insider view to work for buyers. Independent of any vendor, paid by none, and honest about what fits whom.

Methodology Contact LinkedIn