auditing-terraform-infrastructure-for-security

Files (4)

• LICENSE
• SKILL.md
• api-reference.md · references/
• agent.py · scripts/

SKILL.md (first lines)

# Auditing Terraform Infrastructure for Security

## When to Use

- When integrating security scanning into CI/CD pipelines for Terraform deployments
- When reviewing Terraform plans and modules for security best practices before applying
- When building policy-as-code guardrails for cloud infrastructure provisioning
- When auditing existing Terraform state files to identify deployed misconfigurations
- When enforcing organizational security standards across multiple Terraform projects

**Do not use** for runtime security monitoring (use CSPM tools), for application security testing (use SAST/DAST tools), or for cloud configuration drift detection (use AWS Config or Azure Policy after deployment).

## Prerequisites

- Checkov installed (`pip install checkov`)
- tfsec installed (`brew install tfsec` or binary from GitHub)
- Terrascan installed (`brew install terrascan`)
- Terraform v1.0+ for plan generation
- OPA (Open Policy Agent) for custom policy enforcement
- Git repository with Terraform code to audit

## Workflow

### Step 1: Scan Terraform Code with Checkov

Run Checkov for comprehensive IaC security scanning with built-in and custom policies.

```bash
# Scan a Terraform directory
checkov -d ./terraform/ --framework terraform

# Scan with specific check categories
checkov -d ./terraform/ --check CKV_AWS_18,CKV_AWS_19,CKV_AWS_20,CKV_AWS_21

# Scan and output results in JSON
checkov -d ./terraform/ --output json > checkov-results.json

# Scan a Terraform plan file for more accurate analysis
terraform init && terraform plan -out=tfplan
terraform show -json tfplan > tfplan.json
checkov -f tfplan.json --framework terraform_plan

# Skip specific checks with justification
checkov -d ./terraform/ --skip-check CKV_AWS_145 \
  --bc-api-key $BRIDGECREW_API_KEY

# Scan Terraform modules
checkov -d ./modules/ --framework terraform --compact

# List all available checks
checkov --list --framework terraform | grep CKV_AWS
```

### Step 2: Scan with tfsec for Terraform-Specific Issues

Use tfsec for Terraform-native security analysis with detailed remediation guidance.

```bash
# Scan a Terraform directory
tfsec ./terraform/

# Scan with minimum severity threshold
tfsec ./terraform/ --minimum-severity HIGH

# Output in JSON for CI/CD processing
tfsec ./terraform/ --format json > tfsec-results.json

# Scan with custom checks
tfsec ./terraform/ --custom-check-dir ./custom-checks/

# Exclude specific rules
tfsec ./terraform/ --exclude-downloaded-modules \
  --exclude aws-s3-enable-bucket-logging

# Scan and fail on specific severity
tfsec ./terraform/ --minimum-severity CRITICAL --soft-fail

# Generate SARIF output for GitHub Security tab
tfsec ./terraform/ --format sarif > tfsec.sarif
```

### Step 3: Run Terrascan for Multi-Framework Compliance

Execute Terrascan for compliance checking against CIS, NIST, and SOC 2 frameworks.

```bash
# Scan Terraform against CIS AWS benchmark
terrascan scan -t aws -i terraform -d ./terraform/ \
  --policy-type aws --verbose

# Scan against specific compliance frameworks
terrascan scan -t aws -i terraform -d ./terraform/ \
  --policy-type aws \
  --categories "Compliance Validation"

# Output in JSON
terrascan scan -t aws -i terraform -d ./terraform/ \
  --output json > terrascan-results.json

# Scan a Terraform plan
terrascan scan -t aws -i terraform \
  --iac-file tfplan.json \
  --iac-type tfplan

# List available policies
terrascan scan --list-policies -t aws
```

### Step 4: Create Custom OPA Policies for Organization Standards

Write Rego policies for organization-specific security requirements.

```rego
# policy/aws_s3_encryption.rego
package terraform.aws.s3

deny[msg] {
    resource := input.resource.aws_s3_bucket[name]
    not resource.server_side_encryption_configuration

From mukul975/Anthropic-Cybersecurity-Skills, Apache-2.0.

More from mukul975/Anthropic-Cybersecurity-Skills