tomevault-io Terraform Security Review
Guides security reviews of Terraform and OpenTofu infrastructure-as-code across the full lifecycle: authoring, commit, CI/CD, plan-time, and runtime drift detection.
Reference Loading Guide
| Reference | Read when | Consult for |
|---|---|---|
references/static-analysis-tools.md |
Choosing or configuring scanners | Trivy, Checkov, KICS, TFLint, Infracost setup; comparison matrix; finding normalization |
references/workflow-and-gates.md |
Designing gate strategy or pre-commit setup | Pre-commit hooks, PR gate logic, plan-time flow, secret incident response, exception management |
references/ci-cd-integration.md |
Building platform-specific pipelines | GitHub Actions, GitLab CI, Azure DevOps workflows; OIDC/WIF auth; SARIF upload patterns |
references/oidc-hardening.md |
Securing CI/CD cloud credentials | GitHub/GitLab/Azure DevOps OIDC subject claim restrictions; AWS/Azure/GCP trust policies; common misconfigurations |
references/policy-as-code.md |
Writing or reviewing custom governance rules | OPA/Rego policies, Conftest, Sentinel, plan-time evaluation, unknown-value handling, policy testing |
references/native-validation.md |
Using Terraform's built-in security features | Variable validation, preconditions/postconditions, check blocks; no external tools needed |
references/secrets-and-drift.md |
Detecting secrets or infrastructure drift | Gitleaks, TruffleHog, Terraform-specific secret patterns, drift detection, OpenTofu compatibility |
references/supply-chain-and-state.md |
Hardening modules, providers, state, or cloud posture | Provider pinning, module verification, lock files, state encryption, cloud-specific controls, dependency automation |
references/atlantis-and-terragrunt.md |
Using Atlantis or Terragrunt securely | Atlantis PR automation with security gates; Terragrunt security risks (run_cmd, generate); OpenTofu support |
references/sources-and-confidence.md |
Verifying claims or uncertain areas | Source links, evidence notes, and explicitly flagged low-confidence items |
Decision Path
- Classify scope:
code-only(HCL source) → static analysis.plan-aware(plan JSON) → plan-time scanning with Checkov or OPA/Conftest.runtime→ drift detection. - Where in workflow? Developer machine → pre-commit hooks. PR/MR → CI pipeline gates. Post-deploy → scheduled drift checks.
- Custom policies needed? Org-specific rules → OPA/Rego with Conftest or Sentinel. Standard compliance → built-in rulesets from Trivy/Checkov.
- Build layered controls: linter (TFLint) → misconfiguration scanners → secrets scanning → policy-as-code enforcement.
- Emit machine-readable outputs (
sarif,json,junit) so findings can be gated, trended, and audited.
Guardrails
- tfsec is deprecated — use
trivy config .instead (all tfsec check IDs work in Trivy) - Terrascan is archived (Nov 2025, by Tenable) — migrate to Checkov, KICS, or Trivy
- driftctl is in maintenance mode — consider Driftive for new projects; disclose lifecycle constraints before adoption
- Always scan both HCL source and plan JSON — some misconfigurations only surface after variable interpolation
- Never store secrets in Terraform state or variable defaults — use vault references or data sources
- Use short-lived federated CI credentials (OIDC/WIF), not long-lived cloud secrets — always restrict OIDC subject claims to specific repo + branch
- Run at least one parser-diverse scanner pair to reduce single-parser blind spots
- Pin provider and module versions; commit and enforce
.terraform.lock.hclin CI - Use Terraform's native validation (
variable validation,precondition,postcondition) as a first layer — free, no tools required - Automate provider/module updates with Renovate or Dependabot to reduce exposure window
Source: imarios/open-vibes — distributed by TomeVault.