Tfsec Alternatives
Similar projects and alternatives to tfsec
-
trivy
Scanner for vulnerabilities in container images, file systems, and Git repositories, as well as for configuration issues
-
terraform-security-scan
Run a security scan on your terraform with the very nice https://github.com/liamg/tfsec
-
Scout APM
Less time debugging, more time building. Scout APM allows you to find and fix performance issues with no hassle. Now with error monitoring and external services monitoring, Scout is a developer's best friend when it comes to application development.
-
checkov
Prevent cloud misconfigurations during build-time for Terraform, CloudFormation, Kubernetes, Serverless framework and other infrastructure-as-code-languages with Checkov by Bridgecrew.
-
local-log4j-vuln-scanner
Simple local scanner for vulnerable log4j instances
-
cli
a lightweight, security focused, BDD test framework against terraform. (by terraform-compliance)
-
iam-policy-json-to-terraform
Small tool to convert an IAM Policy in JSON format into a Terraform aws_iam_policy_document
-
-
OPS
OPS - Build and Run Open Source Unikernels. Quickly and easily build and deploy open source unikernels in tens of seconds. Deploy in any language to any cloud.
-
docker-bench-security
The Docker Bench for Security is a script that checks for dozens of common best-practices around deploying Docker containers in production.
-
-
-
-
-
kube-bench
Checks whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark
-
-
cloud-custodian
Rules engine for cloud security, cost optimization, and governance, DSL in yaml for policies to query, filter, and take actions on resources
-
-
-
-
-
Reviews and mentions
-
Container security best practices: Comprehensive guide
If you are using infrastructure as code, incorporate IaC scanning tools like Apolicy, Checkov, tfsec, or cfn_nag to validate the configuration of your infrastructure before it is created or updated. Similar to other linting tools, apply IaC scanning tools locally and in your pipeline, and consider blocking changes that introduce security issues.
-
Terraform IaC Scanning with Trivy
Trivy checks Terraform IaC using TFSEC. You can take a look at all the checks that Trivy performs under the included checks documentation. In the previous example above Trivy detected a risk called: Potentially sensitive data stored in block attribute, which notified us that our code was potentially exposing sensitive data.
- GitHub - aquasecurity/tfsec: Security scanner for your Terraform code
- Security scanner for Terraform code. Handy.
-
tf-free: A project to create free resources on all cloud-providers
This is cool, but a suggestion: seeing a lot of "0.0.0.0/0" ingress on security groups. Might want to try to use something like https://tfsec.dev/ to make sure you're using best-practices re: security.
-
A simple security scanner for vulnerabilities and configuration issues in IaC such as Kubernetes, Dockerfile and Terraform
For the IaC scanning there's a couple of rule sources. The Docker and Kubernetes rules come from the AppShield project (https://github.com/aquasecurity/appshield/). The Terraform Scanning is powered by tfsec (https://github.com/aquasecurity/tfsec/)
Stats
aquasecurity/tfsec is an open source project licensed under MIT License which is an OSI approved license.
Popular Comparisons
Are you hiring? Post a new remote job listing for free.