tflint VS tfsec

‍TFLint is a Terraform linter focused on possible errors, best practices, and style conventions in your Terraform code.

TFlint is a powerful linter for Terraform, designed to catch errors and issues that terraform plan may not detect. As Terraform grows in popularity for infrastructure as code, the need for robust tools to ensure code quality and reliability becomes paramount. TFlint fulfills this need by analyzing Terraform configurations to find problems that are not covered by syntax checks. It checks for things like unsuitable AWS instance types, incorrect IAM policy syntax, and the use of deprecated syntax or features. By integrating TFlint into the development process, users can proactively identify potential problems, improving the stability and efficiency of their infrastructure deployments. This additional layer of validation is crucial for maintaining high standards in complex, cloud-based infrastructures.

Looking at the description, https://github.com/terraform-linters/tflint , I think it's not what I am looking for. The reason I used a different tcp port is to make the health check on load balancer fail. It's also the same as not changing the tcp port but developer making a code change in their javascript, nodejs, java, etc fail to start properly. If that happens, load balancer's health check will fail as well.

TFLint is an open-source infrastructure as code linter tool that helps developers and DevOps teams identify potential issues and errors in their Terraform code by checking the Terraform configuration files for best practices, coding standards, and policy compliance.

Indeed, that is the case, atm. Your comment got me searching a little bit more. It seems that they are planning to implement a flag for small fixes https://github.com/terraform-linters/tflint/issues/266

Sounds like tflint to me!

I created a .tflint.hcl with the following content: https://github.com/terraform-linters/tflint/blob/master/docs/user-guide/config.md (The example)

TFLint: This is a Terraform linter that checks for errors and best practices in your Terraform code. TFLint helps to catch common mistakes, such as variable name clashes, missing required variables, or invalid resource arguments. It also checks for compliance with best practices, such as naming conventions and resource ordering. By using TFLint, you can catch errors early on, which helps to improve the quality of your Terraform code.

tflint: Linter para Terraform, serve para avisar sobre problemas com sintaxe, erros nos principais provedores de nuvem, garantir boas práticas e outras coisas.

tfsec Owner/Maintainer: Aqua Security (acquired in 2021) Age: First released on GitHub on March 5th, 2019 License: MIT License tfsec project is no longer actively maintained in favor of the Trivy tool. But because many people still use it and it's quite famous, I added tfsec to this comparison. However, I recommend against using it for new projects.

‍Tfsec acts as a Terraform scanning tool. It is a security-focused linter for Terraform that scans code for security flaws, offering an additional layer of security assurance and helping to maintain a strong security posture.

... #************************** Terraform ************************************* ARG TERRAFORM_VERSION=1.7.3 RUN set -ex \ && curl -O https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip && unzip terraform_${TERRAFORM_VERSION}_linux_amd64.zip -d /usr/local/bin/ RUN set -ex \ && mkdir -p $HOME/.terraform.d/plugin-cache && echo 'plugin_cache_dir = "$HOME/.terraform.d/plugin-cache"' > ~/.terraformrc #************************* Terragrunt ************************************* ARG TERRAGRUNT_VERSION=0.55.1 RUN set -ex \ && wget https://github.com/gruntwork-io/terragrunt/releases/download/v${TERRAGRUNT_VERSION}/terragrunt_linux_amd64 -q \ && mv terragrunt_linux_amd64 /usr/local/bin/terragrunt \ && chmod +x /usr/local/bin/terragrunt #*********************** Terramate **************************************** ARG TERRAMATE_VERSION=0.4.5 RUN set -ex \ && wget https://github.com/mineiros-io/terramate/releases/download/v${TERRAMATE_VERSION}/terramate_${TERRAMATE_VERSION}_linux_x86_64.tar.gz \ && tar -xzf terramate_${TERRAMATE_VERSION}_linux_x86_64.tar.gz \ && mv terramate /usr/local/bin/terramate \ && chmod +x /usr/local/bin/terramate #*********************** tfsec ******************************************** ARG TFSEC_VERSION=1.28.5 RUN set -ex \ && wget https://github.com/aquasecurity/tfsec/releases/download/v${TFSEC_VERSION}/tfsec-linux-amd64 \ && mv tfsec-linux-amd64 /usr/local/bin/tfsec \ && chmod +x /usr/local/bin/tfsec \ && terragrunt --version #**********************Terraform docs ************************************ ARG TERRRAFORM_DOCS_VERSION=0.17.0 RUN set -ex \ && curl -sSLo ./terraform-docs.tar.gz https://terraform-docs.io/dl/v${TERRRAFORM_DOCS_VERSION}/terraform-docs-v${TERRRAFORM_DOCS_VERSION}-$(uname)-amd64.tar.gz \ && tar -xzf terraform-docs.tar.gz \ && chmod +x terraform-docs \ && mv terraform-docs /usr/local/bin/terraform-docs #********************* ShellCheck ***************************************** ARG SHELLCHECK_VERSION="stable" RUN set -ex \ && wget -qO- "https://github.com/koalaman/shellcheck/releases/download/${SHELLCHECK_VERSION?}/shellcheck-${SHELLCHECK_VERSION?}.linux.x86_64.tar.xz" | tar -xJv \ && cp "shellcheck-${SHELLCHECK_VERSION}/shellcheck" /usr/bin/ \ && shellcheck --version ...

You can give tfsec a try perhaps

Great toolchain, including Infracost or tfsec.

TFSec is an open-source tool for scanning and detecting potential security vulnerabilities in Terraform code in both HCL and JSON.

We use https://github.com/aquasecurity/tfsec we found checkov.io to be quite noisy

Beyond Snyk and Checkov - I have also used https://github.com/aquasecurity/tfsec at a few organizations both for use locally and in CI (PR Review Checks)

Once I completed the main steps of the challenge, I went back to do some security modificaions including enabled DNSSEC, deploying WAF (I ended up removing this as the costs were quite high and instead set up account level throttling for my API) and running IAM Access Analyser to flag anything I'd over permissioned. I also set up Git commit signing and added a new Git Action workflow to run Tfsec any time I updated my terraform config files