security-review-skill-for-terraform

To scan Terraform code for hard-coded credentials and AWS IAM misconfigurations, apply a security audit to your .tf, .tfvars, JSON, or Terragrunt files. This surfaces overly permissive policies and provides structured findings with remediation guidance.

Detecting public S3 exposure and unencrypted storage in Terraform IaC involves auditing your configurations for insecure resource definitions. The process identifies vulnerable storage settings and outputs actionable fixes to secure your AWS infrastructure.

Yes, you can run a Terraform security audit during CI/CD pipeline deployment. Applying the audit to your repositories and pipelines surfaces security risks and misconfigurations during development, allowing you to generate a remediation plan before deployment.

The IaC security review works with Terragrunt and JSON configurations, alongside standard Terraform HCL files. It analyzes these formats to detect insecure provider or module usage, missing logging, and privileged container settings across your codebase.

Auditing Terraform state files for leaked data and missing logs prevents sensitive information exposure and ensures traceability. The audit identifies leaked state data and missing logging configurations, outputting structured findings to secure your AWS resources.