# Imarios Open Vibes Terraform Security Review > Terraform Security Review - Skill: `tomevault-io/imarios-open-vibes-terraform-security-review` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/imarios-open-vibes-terraform-security-review` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/imarios-open-vibes-terraform-security-review/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/imarios-open-vibes-terraform-security-review --- # Terraform Security Review Guides security reviews of Terraform and OpenTofu infrastructure-as-code across the full lifecycle: authoring, commit, CI/CD, plan-time, and runtime drift detection. ## Reference Loading Guide | Reference | Read when | Consult for | |-----------|-----------|-------------| | `references/static-analysis-tools.md` | Choosing or configuring scanners | Trivy, Checkov, KICS, TFLint, Infracost setup; comparison matrix; finding normalization | | `references/workflow-and-gates.md` | Designing gate strategy or pre-commit setup | Pre-commit hooks, PR gate logic, plan-time flow, secret incident response, exception management | | `references/ci-cd-integration.md` | Building platform-specific pipelines | GitHub Actions, GitLab CI, Azure DevOps workflows; OIDC/WIF auth; SARIF upload patterns | | `references/oidc-hardening.md` | Securing CI/CD cloud credentials | GitHub/GitLab/Azure DevOps OIDC subject claim restrictions; AWS/Azure/GCP trust policies; common misconfigurations | | `references/policy-as-code.md` | Writing or reviewing custom governance rules | OPA/Rego policies, Conftest, Sentinel, plan-time evaluation, unknown-value handling, policy testing | | `references/native-validation.md` | Using Terraform's built-in security features | Variable validation, preconditions/postconditions, check blocks; no external tools needed | | `references/secrets-and-drift.md` | Detecting secrets or infrastructure drift | Gitleaks, TruffleHog, Terraform-specific secret patterns, drift detection, OpenTofu compatibility | | `references/supply-chain-and-state.md` | Hardening modules, providers, state, or cloud posture | Provider pinning, module verification, lock files, state encryption, cloud-specific controls, dependency automation | | `references/atlantis-and-terragrunt.md` | Using Atlantis or Terragrunt securely | Atlantis PR automation with security gates; Terragrunt security risks (run_cmd, generate); OpenTofu support | | `references/sources-and-confidence.md` | Verifying claims or uncertain areas | Source links, evidence notes, and explicitly flagged low-confidence items | ## Decision Path 1. **Classify scope**: `code-only` (HCL source) → static analysis. `plan-aware` (plan JSON) → plan-time scanning with Checkov or OPA/Conftest. `runtime` → drift detection. 2. **Where in workflow?** Developer machine → pre-commit hooks. PR/MR → CI pipeline gates. Post-deploy → scheduled drift checks. 3. **Custom policies needed?** Org-specific rules → OPA/Rego with Conftest or Sentinel. Standard compliance → built-in rulesets from Trivy/Checkov. 4. **Build layered controls**: linter (TFLint) → misconfiguration scanners → secrets scanning → policy-as-code enforcement. 5. **Emit machine-readable outputs** (`sarif`, `json`, `junit`) so findings can be gated, trended, and audited. ## Guardrails - tfsec is deprecated — use `trivy config .` instead (all tfsec check IDs work in Trivy) - **Terrascan is archived** (Nov 2025, by Tenable) — migrate to Checkov, KICS, or Trivy - driftctl is in maintenance mode — consider Driftive for new projects; disclose lifecycle constraints before adoption - Always scan both HCL source *and* plan JSON — some misconfigurations only surface after variable interpolation - Never store secrets in Terraform state or variable defaults — use vault references or data sources - Use short-lived federated CI credentials (OIDC/WIF), not long-lived cloud secrets — always restrict OIDC subject claims to specific repo + branch - Run at least one parser-diverse scanner pair to reduce single-parser blind spots - Pin provider and module versions; commit and enforce `.terraform.lock.hcl` in CI - Use Terraform's native validation (`variable validation`, `precondition`, `postcondition`) as a first layer — free, no tools required - Automate provider/module updates with Renovate or Dependabot to reduce exposure window --- > Source: [imarios/open-vibes](https://github.com/imarios/open-vibes) — distributed by [TomeVault](https://tomevault.io).