terraform-security-audit

To audit Terraform AWS infrastructure for security vulnerabilities, you inspect IAM policy documents for least-privilege, trace network exposure through subnets and security groups, validate KMS encryption settings, and analyze Checkov skips to produce a structured risk report.

Finding overly broad IAM access in Terraform code requires expanding aws_iam_policy_document blocks to spot wildcard actions, excessive resource scopes, and missing trust conditions during a static security assessment.

Tracing public-to-private network exposure paths in Terraform involves mapping ingress and egress risks through subnets, security groups, and NACLs to uncover hidden routes from public to private resources.

Verifying KMS encryption settings and secure transport in Terraform components requires checking that data stores, logs, and backups use customer-managed keys and enforce secure transport configurations.

Identifying unsafe Checkov skips during a static Terraform security assessment is possible by analyzing skipped security checks to determine if they mask actual vulnerabilities or policy flaws in your AWS infrastructure.