Terraform Audit

Terraform Audit Skill

Perform a comprehensive audit of a Terraform codebase across four dimensions: security & compliance, cost optimization, code quality, and architecture design. The audit produces a structured Markdown report with findings classified by severity. Rules are grounded in the CIS AWS Foundations Benchmark and the AWS Well-Architected Framework, with a primary focus on AWS resources.

Description

Perform a comprehensive audit of a Terraform codebase covering four dimensions: security and compliance, cost optimization, code quality, and architecture design. Based on the CIS AWS Foundations Benchmark and the AWS Well-Architected Framework, output a structured Markdown audit report for AWS resources classified by Critical / Important / Minor severity levels.

Execution Guidelines

• Scan the project structure before auditing; determine scale by the number of .tf files (Small / Medium / Large) and choose the corresponding strategy
• Execute the four dimensions in order: Security -> Cost -> Quality -> Architecture, reading the corresponding sub-module checklist for each
• Every finding must include a severity level, affected file and line number, and specific remediation advice (including HCL code)
• Use the report-template.md template for the report, saved to the project root directory
• When cross-dimensional complementary rules exist (e.g., Multi-AZ in both architecture and cost), annotate the cross-reference context

Examples

Bad

# S3 bucket with no encryption, no versioning, public access
resource "aws_s3_bucket" "data" {
  bucket = "my-data-bucket"
}

resource "aws_s3_bucket_public_access_block" "data" {
  bucket                  = aws_s3_bucket.data.id
  block_public_acls       = false
  block_public_policy     = false
  ignore_public_acls      = false
  restrict_public_buckets = false
}

✅ Good

resource "aws_s3_bucket" "data" {
  bucket = "${var.project}-${var.environment}-data"
}

resource "aws_s3_bucket_versioning" "data" {
  bucket = aws_s3_bucket.data.id
  versioning_configuration { status = "Enabled" }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "data" {
  bucket = aws_s3_bucket.data.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.main.arn
    }
  }
}

resource "aws_s3_bucket_public_access_block" "data" {
  bucket                  = aws_s3_bucket.data.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

Audit Workflow

Copy this checklist and update it as you progress:

Audit Progress:
- [ ] Step 1: Scan project structure
- [ ] Step 2: Security & compliance audit
- [ ] Step 3: Cost optimization audit
- [ ] Step 4: Code quality audit
- [ ] Step 5: Architecture design audit
- [ ] Step 6: Generate report

Step 1: Scan Project Structure

Use Glob to find all **/*.tf files in the target project. Then determine:

• Module structure: Identify root module, nested modules, and shared/reusable modules.
• Backend configuration: Check for remote state backend (S3, GCS, Terraform Cloud, etc.) and state locking.
• Provider usage: List providers and their version constraints.
• Terraform version: Check required_version in terraform {} blocks.
• Project scale:
  • Small: < 10 .tf files — audit all files in a single pass.
  • Medium: 10-30 .tf files — group by module, audit each module.
  • Large: 30+ .tf files — prioritize root module and shared modules first, then environment-specific configs.

Record the scale; it determines the audit strategy in later steps.

Step 2: Security & Compliance Audit

Read security-checklist.md and apply each rule to the scanned codebase.

Categories covered: IAM policies & roles, S3 bucket configuration, networking (security groups, NACLs, public access), encryption at rest and in transit, logging & monitoring, secrets management.

Classify every finding as Critical, Important, or Minor per the severity table below.

Step 3: Cost Optimization Audit

Read cost-optimization.md and apply each rule to the scanned codebase.

Categories covered: Compute right-sizing, storage tiering & lifecycle, database instance sizing & reserved capacity, networking costs (NAT gateways, data transfer), tagging & cost governance.

Classify every finding as Critical, Important, or Minor.

Step 4: Code Quality Audit

Read code-quality.md and apply each rule to the scanned codebase.

Categories covered: Modularity & reuse, naming conventions, variable & output hygiene, state management, provider & module version pinning, DRY principle adherence, file & directory structure.

Classify every finding as Critical, Important, or Minor.

Step 5: Architecture Design Audit

Read architecture-review.md and apply each rule to the scanned codebase.

Categories covered: High availability, disaster recovery, network design (VPC layout, subnet strategy, connectivity), environment isolation, scalability & auto-scaling readiness.

Classify every finding as Critical, Important, or Minor.

Issue Severity Classification

Step 6: Generate Report

Read report-template.md for the exact output format.

• Save the report to {project_root}/terraform-audit-report.md.
• Within each dimension, sort findings by severity: Critical first, then Important, then Minor.
• The executive summary must include total finding counts per severity level and an overall assessment (PASS / NEEDS ATTENTION / CRITICAL ISSUES).

Project Scale Adaptation