Terraform Security Audit
Overview
Deep security audit for Terraform AWS components that complements Checkov static analysis. This skill catches patterns that automated scanners miss: overly broad IAM policies, NACL ephemeral port gaps, encryption using AWS-managed keys instead of CMKs, and policy documents that are technically valid but operationally dangerous.
When to Use
- After Checkov passes but you want deeper policy analysis
- When reviewing IAM policies for least-privilege compliance
- When auditing network security group and NACL configurations
- When validating encryption configuration meets organizational standards
- During security review of new or modified AWS components
When NOT to Use
- For syntax-only validation -- use
terraform validate instead
- When Checkov has not been run yet -- run Checkov first, then use this skill for deeper analysis
- For non-AWS providers (this skill is AWS-specific)
- For Terraform module API design reviews -- use a general code review instead
- For runtime security monitoring or incident response -- this is static code audit only
Workflow
- Collect scope: Identify all
.tf files in the component
- IAM audit: Read every
aws_iam_policy_document and inline policy. Expand wildcards, verify resource scoping, check conditions on sensitive actions, flag "*" in actions or resources
- Network trace: Map subnets and route tables. Trace paths from Internet through IGW, public subnets, security groups, and NACLs to private resources. Check both IPv4 and IPv6 rules
- Encryption check: List all data-storing resources (S3, RDS, EBS, DynamoDB, CloudWatch). Verify CMK usage, key rotation, encryption in transit, and that logs/backups inherit encryption
- Checkov review: Validate skip justifications are meaningful and scoped. Confirm critical checks are not skipped without strong justification
- Produce report: Use the template from
templates.md
See audit-dimensions.md for detailed check tables and verification steps for each dimension.
Critical Checks
These are the highest-priority items to flag:
Effect = "Allow" with Action = "*" or Resource = "*"- Security groups or NACLs open to
::/0 (IPv6 internet)
- Data resources using
aws/s3 or aws/rds managed keys instead of CMKs
- CloudWatch log groups missing
kms_key_id
- Checkov skips on critical checks (CKV_AWS_144, CKV_AWS_145, CKV2_AWS_19) without strong justification
- Cross-account trust policies missing
sts:ExternalId condition
Common Mistakes
| Mistake |
Why It Happens |
Correct Approach |
| Reporting only Checkov findings |
Over-reliance on scanner output |
Checkov is the baseline; manually expand wildcards and trace network paths |
| Ignoring IPv6 rules |
IPv4 rules look secure |
Always check both cidr_blocks and ipv6_cidr_blocks on every SG rule |
Treating aws/s3 default key as sufficient |
Encryption is technically present |
CMK is required for key rotation control and cross-account grant ability |
| Skipping egress rule review |
Egress defaults to allow-all |
Sensitive subnets need explicit egress restrictions |
| Accepting vague Checkov skip reasons |
Skip exists so it must be intentional |
Every skip must have a specific, meaningful justification |
| Missing log/backup encryption gaps |
Main resource is encrypted |
Cross-check that CloudWatch logs, replicas, and backups also use CMKs |
Supporting Files
audit-dimensions.md -- Detailed check tables for IAM, network, encryption, and Checkov dimensionstemplates.md -- Report output template
Source: infraspecdev/tesseract — distributed by TomeVault.
1---2name: terraform-security-audit3description: Use when auditing Terraform code for security vulnerabilities, reviewing IAM policies, checking encryption, or validating network isolation in AWS components4---56# Terraform Security Audit78## Overview910Deep security audit for Terraform AWS components that complements Checkov static analysis. This skill catches patterns that automated scanners miss: overly broad IAM policies, NACL ephemeral port gaps, encryption using AWS-managed keys instead of CMKs, and policy documents that are technically valid but operationally dangerous.1112## When to Use1314- After Checkov passes but you want deeper policy analysis15- When reviewing IAM policies for least-privilege compliance16- When auditing network security group and NACL configurations17- When validating encryption configuration meets organizational standards18- During security review of new or modified AWS components1920## When NOT to Use2122- For syntax-only validation -- use `terraform validate` instead23- When Checkov has not been run yet -- run Checkov first, then use this skill for deeper analysis24- For non-AWS providers (this skill is AWS-specific)25- For Terraform module API design reviews -- use a general code review instead26- For runtime security monitoring or incident response -- this is static code audit only2728## Workflow29301. **Collect scope**: Identify all `.tf` files in the component312. **IAM audit**: Read every `aws_iam_policy_document` and inline policy. Expand wildcards, verify resource scoping, check conditions on sensitive actions, flag `"*"` in actions or resources323. **Network trace**: Map subnets and route tables. Trace paths from Internet through IGW, public subnets, security groups, and NACLs to private resources. Check both IPv4 and IPv6 rules334. **Encryption check**: List all data-storing resources (S3, RDS, EBS, DynamoDB, CloudWatch). Verify CMK usage, key rotation, encryption in transit, and that logs/backups inherit encryption345. **Checkov review**: Validate skip justifications are meaningful and scoped. Confirm critical checks are not skipped without strong justification356. **Produce report**: Use the template from `templates.md`3637See `audit-dimensions.md` for detailed check tables and verification steps for each dimension.3839## Critical Checks4041These are the highest-priority items to flag:4243- `Effect = "Allow"` with `Action = "*"` or `Resource = "*"`44- Security groups or NACLs open to `::/0` (IPv6 internet)45- Data resources using `aws/s3` or `aws/rds` managed keys instead of CMKs46- CloudWatch log groups missing `kms_key_id`47- Checkov skips on critical checks (CKV_AWS_144, CKV_AWS_145, CKV2_AWS_19) without strong justification48- Cross-account trust policies missing `sts:ExternalId` condition4950## Common Mistakes5152| Mistake | Why It Happens | Correct Approach |53|---------|---------------|-----------------|54| Reporting only Checkov findings | Over-reliance on scanner output | Checkov is the baseline; manually expand wildcards and trace network paths |55| Ignoring IPv6 rules | IPv4 rules look secure | Always check both `cidr_blocks` and `ipv6_cidr_blocks` on every SG rule |56| Treating `aws/s3` default key as sufficient | Encryption is technically present | CMK is required for key rotation control and cross-account grant ability |57| Skipping egress rule review | Egress defaults to allow-all | Sensitive subnets need explicit egress restrictions |58| Accepting vague Checkov skip reasons | Skip exists so it must be intentional | Every skip must have a specific, meaningful justification |59| Missing log/backup encryption gaps | Main resource is encrypted | Cross-check that CloudWatch logs, replicas, and backups also use CMKs |6061## Supporting Files6263- `audit-dimensions.md` -- Detailed check tables for IAM, network, encryption, and Checkov dimensions64- `templates.md` -- Report output template6566---67> Source: [infraspecdev/tesseract](https://github.com/infraspecdev/tesseract) — distributed by [TomeVault](https://tomevault.io).68<!-- tomevault:4.0:skill_md:2026-06-16 -->
tomevault-io