tfsec was a static analysis security scanner for Terraform code. It detected misconfigurations in AWS, Azure, GCP, and other cloud provider resources before infrastructure deployment. The project was acquired by Aqua Security and fully merged into Trivy in 2023.
All tfsec functionality is now available in Trivy’s misconfiguration scanner.
What tfsec did
tfsec scanned Terraform files for security issues like unencrypted storage, overly permissive security groups, missing logging, and exposed secrets. The scanner ran locally, in CI/CD pipelines, and as a pre-commit hook.
Written in Go, it shipped as a single binary with no dependencies. Point it at Terraform code, get a list of findings with severity ratings and remediation guidance.
Why tfsec was merged into Trivy
Aqua Security acquired tfsec in 2021 and integrated the Terraform scanning engine into Trivy. This gave Trivy users Terraform security scanning alongside container vulnerability detection, Kubernetes cluster scanning, and secret detection in one tool.
The merger eliminated the need to maintain separate tools for different security scanning tasks. tfsec users gained access to Trivy’s broader ecosystem, CI/CD integrations, and container image scanning capabilities.
Migration to Trivy
Trivy includes all tfsec checks with identical check IDs. Replace tfsec commands with trivy config for drop-in compatibility.
Before (tfsec):
tfsec .
After (Trivy):
trivy config .
Check IDs like AVD-AWS-0086 work unchanged. Severity filtering, JSON output, and custom check support transfer directly to Trivy.
Alternatives to tfsec
For Terraform security scanning, Trivy replaces tfsec with the same check library plus broader scanning capabilities.
Checkov offers more IaC policy checks across Terraform, CloudFormation, Kubernetes, and Ansible. KICS provides compliance framework mapping for CIS Benchmarks, PCI-DSS, and GDPR.
For commercial Terraform scanning with fix suggestions and developer guidance, Snyk IaC integrates into IDEs and pull requests.
For a broader view of Terraform security, see our cloud infrastructure security guide. Browse other IaC security tools for additional options.
Note: Merged into Trivy. All tfsec checks are now available in Trivy's misconfiguration scanner. Users should migrate to Trivy for Terraform security scanning.
