atmos VS tfsec

This is why we created atmos to make it easier to manage large multi-account architectures. As a result, our components are reusable across organizations, regardless of how many accounts and regions they operate, and we minimize the snowflakes. And we avoid code generation, which is hard to thoroughly test in an automated fashion. Without naming names, lots of tools for terraform rely on code generation, but I see it as an anti-pattern that should be avoided.

sorry did not find anything advanced. A better tool to make terraform scaleable is https://atmos.tools

Workspaces are incredibly practical, and we leveraging them at-scale with literally thousands of workspaces using atmos for terraform. There is so much FUD around workspaces that is either ill-informed or based on outdated information. Any company using terraform at scale will rely on tooling and conventions. It's up to that tooling to ensure you are using terraform safely. Atmos is one of those tools. I'm not saying that you have to use workspaces, but just that there's nothing wrong with workspaces themselves.

Check out atmos for a fresh take at managing terraform configurations and terraform workflows. Instead of managing HCL `.tfvar` files manually for configuration, it uses YAML, and supports concepts of imports (via deep merging), remote imports (anything supported by gogetter), mixins, inheritance, multiple-inheritance, vendoring of root modules, workflows, task runners (via custom subcommands), and much more. There's a bit of a learning curve and mind-shift required if coming from a Terragrunt background, but the experience is mindblowing after switching to it. Also, it's not limited to terraform.

We obviously don't have a project for your exact use case, but we have an open-source example repo that shows a fairly advanced scenario of using the Terraform Spacelift Provider https://github.com/spacelift-io/demo-preview-environments-manager, a simple quickstart of using it https://github.com/spacelift-io/terraform-starter and you can also see the CloudPosse Atmos project, for a very advanced scenario which generates lot's of Stacks based on your component specifications https://github.com/cloudposse/atmos.

3. tfsec: https://github.com/aquasecurity/tfsec tfsec uses a suite of security checks to scan your Terraform templates, helping to identify potential security issues before infrastructure is deployed.

tfsec Owner/Maintainer: Aqua Security (acquired in 2021) Age: First released on GitHub on March 5th, 2019 License: MIT License tfsec project is no longer actively maintained in favor of the Trivy tool. But because many people still use it and it's quite famous, I added tfsec to this comparison. However, I recommend against using it for new projects.

‍Tfsec acts as a Terraform scanning tool. It is a security-focused linter for Terraform that scans code for security flaws, offering an additional layer of security assurance and helping to maintain a strong security posture.

... #************************** Terraform ************************************* ARG TERRAFORM_VERSION=1.7.3 RUN set -ex \ && curl -O https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip && unzip terraform_${TERRAFORM_VERSION}_linux_amd64.zip -d /usr/local/bin/ RUN set -ex \ && mkdir -p $HOME/.terraform.d/plugin-cache && echo 'plugin_cache_dir = "$HOME/.terraform.d/plugin-cache"' > ~/.terraformrc #************************* Terragrunt ************************************* ARG TERRAGRUNT_VERSION=0.55.1 RUN set -ex \ && wget https://github.com/gruntwork-io/terragrunt/releases/download/v${TERRAGRUNT_VERSION}/terragrunt_linux_amd64 -q \ && mv terragrunt_linux_amd64 /usr/local/bin/terragrunt \ && chmod +x /usr/local/bin/terragrunt #*********************** Terramate **************************************** ARG TERRAMATE_VERSION=0.4.5 RUN set -ex \ && wget https://github.com/mineiros-io/terramate/releases/download/v${TERRAMATE_VERSION}/terramate_${TERRAMATE_VERSION}_linux_x86_64.tar.gz \ && tar -xzf terramate_${TERRAMATE_VERSION}_linux_x86_64.tar.gz \ && mv terramate /usr/local/bin/terramate \ && chmod +x /usr/local/bin/terramate #*********************** tfsec ******************************************** ARG TFSEC_VERSION=1.28.5 RUN set -ex \ && wget https://github.com/aquasecurity/tfsec/releases/download/v${TFSEC_VERSION}/tfsec-linux-amd64 \ && mv tfsec-linux-amd64 /usr/local/bin/tfsec \ && chmod +x /usr/local/bin/tfsec \ && terragrunt --version #**********************Terraform docs ************************************ ARG TERRRAFORM_DOCS_VERSION=0.17.0 RUN set -ex \ && curl -sSLo ./terraform-docs.tar.gz https://terraform-docs.io/dl/v${TERRRAFORM_DOCS_VERSION}/terraform-docs-v${TERRRAFORM_DOCS_VERSION}-$(uname)-amd64.tar.gz \ && tar -xzf terraform-docs.tar.gz \ && chmod +x terraform-docs \ && mv terraform-docs /usr/local/bin/terraform-docs #********************* ShellCheck ***************************************** ARG SHELLCHECK_VERSION="stable" RUN set -ex \ && wget -qO- "https://github.com/koalaman/shellcheck/releases/download/${SHELLCHECK_VERSION?}/shellcheck-${SHELLCHECK_VERSION?}.linux.x86_64.tar.xz" | tar -xJv \ && cp "shellcheck-${SHELLCHECK_VERSION}/shellcheck" /usr/bin/ \ && shellcheck --version ...

You can give tfsec a try perhaps

Great toolchain, including Infracost or tfsec.

TFSec is an open-source tool for scanning and detecting potential security vulnerabilities in Terraform code in both HCL and JSON.

We use https://github.com/aquasecurity/tfsec we found checkov.io to be quite noisy

Beyond Snyk and Checkov - I have also used https://github.com/aquasecurity/tfsec at a few organizations both for use locally and in CI (PR Review Checks)