skills.rest
ivanshamaev
ivanshamaevCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

infra-terraform-security-scan

Scan Terraform configurations with tfsec and Checkov for security issues.

14|1|Updated May 5, 2026
Search Tags:#static analysis#terraform#policy as code#tfsec#checkov#sarif#iac security
One-click install
npx skills add https://github.com/ivanshamaev/de-agent-skills --skill infra-terraform-security-scan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: infra-terraform-security-scan
Source: https://github.com/ivanshamaev/de-agent-skills/tree/main/group_skills/infra_dataops_group_skills/infra_terraform_security_scan
Command: npx skills add https://github.com/ivanshamaev/de-agent-skills --skill infra-terraform-security-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you prevent insecure Terraform infrastructure changes by finding common AWS/GCP/Azure misconfigurations and policy violations before they reach production.

Core Features & Use Cases

  • tfsec static analysis: Detects risky Terraform patterns such as missing encryption, overly broad access, and weak security group rules.
  • Checkov policy checks (750+ rules): Enforces CIS-aligned and best-practice security policies across major clouds.
  • CI/CD security gates: Produces SARIF outputs for GitHub Security tab and supports fail/soft-fail behavior for PR workflows.

Use case: You open a PR that changes IAM, S3, and security group settings; use this Skill to scan the Terraform plan/code and ensure encryption, least privilege, logging, and public access restrictions meet compliance requirements.

Quick Start

Run tfsec and Checkov on your Terraform directory and upload the SARIF results to the GitHub Security tab for PR review.

Frequently Asked Questions about infra-terraform-security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan Terraform for security risks before deploying to AWS or Azure?▼

Run tfsec and Checkov static analysis on your Terraform directory to detect insecure infrastructure configurations like missing encryption or overly broad access before merging or deploying.

What is the best way to enforce CIS benchmark compliance in Terraform CI/CD pipelines?▼

The best way to enforce CIS compliance in Terraform CI/CD pipelines is by running policy-as-code checks with Checkov, applying minimum severity gating, and uploading SARIF outputs to the GitHub Security tab for PR review.

Can I fail a pull request if tfsec finds high severity vulnerabilities in my IaC?▼

Yes, you can fail a pull request by configuring minimum severity gating and fail or soft-fail behavior in your CI/CD workflow, ensuring that high severity Terraform security vulnerabilities block merges.

Does this static analysis approach support SARIF output for GitHub Security tab integration?▼

Yes, this static analysis approach supports SARIF output for GitHub Security tab integration, allowing you to visualize Terraform policy violations and security misconfigurations directly within your pull requests.

What types of Terraform misconfigurations can Checkov and tfsec detect?▼

Checkov and tfsec detect Terraform misconfigurations such as missing encryption, weak security group rules, overly broad IAM access, and public access restrictions using over 750 built-in policy-as-code rules.

How do I handle false positives during Terraform policy as code scanning?▼

You can handle false positives during Terraform policy-as-code scanning by applying suppression handling within your tfsec and Checkov configurations, allowing you to bypass specific rules while maintaining overall compliance visibility.

Related Skills

Explore More Legal & Compliance Skills→
wyattowalshwyattowalsh
4

infrastructure-coder

Generate, review, and analyze Terraform, Kubernetes, and Docker Infrastructure-as-Code configurations.

Community
Advanced
erenisiklarerenisiklar

sarif-parsing

Parse and analyze SARIF security findings for triage and CI/CD integration.

Community
Advanced
ddarkrddarkr
5

oma-tf-infra

Automate multi-cloud Terraform infrastructure design, review, and management.

Community
Advanced
andisabandisab

security-validation

Automate security scanning and policy validation for Infrastructure as Code resources.

Community
Advanced